CVE-2025-23053

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networking Fabric Composer (AFC)	>= 7.0.0, <= 7.1.0

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_USVendor Advisory

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-230546.5A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege ope CVE-2025-230555.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230565.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230575.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230588.1A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote atta CVE-2025-230594.9A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensit CVE-2025-23065.9An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sens CVE-2025-230608.1A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information.CVE-2025-230619.8Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exist CVE-2025-23077.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Infor CVE-2025-230725.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki CVE-2025-230733.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows