Reflected Cross-Site Scripting Vulnerability in AOS-10 Gateway and AOS-8 Controller by HPE
CVE-2025-27084

5.4MEDIUM

Key Information:

Vendor
HP (HP)
Status
HP Aruba Networking Aos
Vendor
CVE Published:
8 April 2025

Summary

A reflected cross-site scripting vulnerability has been identified in the Captive Portal of the AOS-10 Gateway and AOS-8 Controller/Mobility Conductor by Hewlett Packard Enterprise. This vulnerability allows a remote attacker to craft a malicious script that can be executed in the victim's web browser. When successfully exploited, this flaw can enable unauthorized script execution within the context of the affected interface, posing significant security risks to users interacting with those systems.

Affected Version(s)

HPE Aruba Networking AOS 10.7.0.0 <= 10.7.1.0

HPE Aruba Networking AOS 10.4.0.0 <= 10.4.1.6

HPE Aruba Networking AOS 8.12.0.0 <= 8.12.0.3

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.