Denial of Service Vulnerability in AOS-8 Instant and AOS 10 by HPE
CVE-2025-37148

6.5MEDIUM

Key Information:

Vendor

HP (HP)

Status
Arubaos (aos)
Vendor
CVE Published:
14 October 2025

What is CVE-2025-37148?

A critical vulnerability exists in the parsing of Ethernet frames within AOS-8 Instant and AOS 10 products from HPE. This flaw may allow an unauthenticated remote attacker to execute a denial of service attack, potentially disrupting network services and necessitating manual intervention to restore system functionality. Organizations using these products should implement patching and protective measures to safeguard against exploitation.

Affected Version(s)

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.7.0.0 <= 10.7.1.1

ArubaOS (AOS) 10.4.0.0 <= 10.4.1.8

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Colton Bachman
Nicholas Starke
JSON
.
CVE-2025-37148 : Denial of Service Vulnerability in AOS-8 Instant and AOS 10 by HPE