Session Hijacking Vulnerability in AOS-CX OS User Authentication by HPE
CVE-2025-37159

5.8MEDIUM

Key Information:

Vendor

HP (HP)

Status
HP Aruba Networking Aos-cx
Vendor
CVE Published:
18 November 2025

What is CVE-2025-37159?

A vulnerability exists in the web management interface of the AOS-CX OS user authentication service, allowing authenticated remote attackers to hijack active user sessions. This exploitation could provide unauthorized access, potentially enabling the attackers to view or alter sensitive configuration data, posing significant risks to system integrity and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HPE Aruba Networking AOS-CX 10.16.0000 <= 10.16.1000

HPE Aruba Networking AOS-CX 10.16.0000 <= 10.16.1000

HPE Aruba Networking AOS-CX 10.15.0000 <= 10.15.1020

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x50d
JSON
.