Authenticated Command Injection Vulnerability in AOS-8 Controller by HPE
CVE-2025-37134

7.2HIGH

Key Information:

Vendor

HP (HP)

Status
Arubaos (aos)
Vendor
CVE Published:
14 October 2025

What is CVE-2025-37134?

An authenticated command injection vulnerability exists within the command-line interface (CLI) binary of HPE's AOS-8 Controller and Mobility Conductor operating systems. This vulnerability poses a significant risk as it allows an authenticated malicious actor to execute arbitrary commands with privileged user rights on the underlying operating system. Consequently, this can lead to unauthorized access and manipulation of system resources. Organizations utilizing AOS-8 Controllers and Mobility Conductors should ensure they implement best security practices to mitigate potential risks associated with this vulnerability.

Affected Version(s)

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.4.0.0 <= 10.4.1.8

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zzcentury from Ubisectech Sirius Team
JSON
.
CVE-2025-37134 : Authenticated Command Injection Vulnerability in AOS-8 Controller by HPE