CVE-2025-25041

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM (root). A successful exploit could allow the creation of a Denial-of-Service (DoS) condition affecting the Microsoft Windows Operating System. This vulnerability does not affect Linux and Android based clients.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-250424.3A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information.CVE-2025-250445.4IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arb CVE-2025-250454.3IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returne CVE-2025-250463.7IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be e CVE-2025-250486.5IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated u CVE-2025-25059.8The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' param CVE-2025-250508.8An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and D CVE-2025-250516.1An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lat CVE-2025-250525.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow.CVE-2025-250538.8OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary CVE-2025-250546.1Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plu CVE-2025-250555.3Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation.