Arbitrary File Deletion in AOS-8 Controller by HPE
CVE-2025-37137

6.5MEDIUM

Key Information:

Vendor

HP (HP)

Status
Arubaos (aos)
Vendor
CVE Published:
14 October 2025

What is CVE-2025-37137?

Arbitrary file deletion vulnerabilities exist in the command-line interface of an AOS-8 Controller/Mobility Conductor, allowing authenticated remote malicious actors to delete arbitrary files on the affected system. Successful exploitation poses significant risks to system integrity and data security, necessitating immediate action to secure affected installations.

Affected Version(s)

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.4.0.0 <= 10.4.1.8

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LIUPENG
JSON
.
CVE-2025-37137 : Arbitrary File Deletion in AOS-8 Controller by HPE