Secure Boot Bypass in HPE Access Points
CVE-2025-37147

7.1HIGH

Key Information:

Vendor

HP (HP)

Status
Arubaos (aos)
Vendor
CVE Published:
14 October 2025

What is CVE-2025-37147?

A vulnerability in HPE Access Points allows an attacker to circumvent the Secure Boot mechanism, which is designed to prevent unauthorized firmware execution. This flaw enables the deployment of modified or custom firmware, potentially compromising the security and integrity of the device and its network. Exploiting this vulnerability could lead to unauthorized access and manipulation of network resources.

Affected Version(s)

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.4.0.0 <= 10.4.1.8

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicholas Starke
JSON
.
CVE-2025-37147 : Secure Boot Bypass in HPE Access Points