CVE-2025-27078

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)AOS-10 AP>= 10.7.0.0, <= 10.7.0.1; >= 10.4.0.0, <= 10.4.1.5; >= 8.12.0.0, <= 8.12.0.3; >= 8.10.0.0, <= 8.10.0.15

References

Timeline

Published
Apr 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-270796.0A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remotCVE-2025-27089.1A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/uploaCVE-2025-270806.0Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. SuccesCVE-2025-270816.8A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of SerCVE-2025-270827.2Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility ConductCVE-2025-270837.2Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interfacCVE-2025-270846.1A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a refCVE-2025-270854.9Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploiCVE-2025-270868.1A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.CVE-2025-270875.5A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack.CVE-2025-270888.2oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attaCVE-2025-270894.3Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies