CVE-2025-37128

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-250

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE Aruba Networking EdgeConnect SD-WAN Gateway>= 9.5.0.0, <= 9.5.3.6; >= 9.4.0.0, <= 9.4.3.7

References

Timeline

Published
Sep 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-371296.7A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script exCVE-2025-37137.5The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenCVE-2025-371306.5A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within theCVE-2025-371314.9A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthCVE-2025-371327.2An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility ConduCVE-2025-371337.2An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. SuccesCVE-2025-371347.2An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. SuccesCVE-2025-371356.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. SuccesCVE-2025-371366.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. SuccesCVE-2025-371376.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. SuccesCVE-2025-371386.2An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility ConCVE-2025-371396.0A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successf
CVE-2025-37128: Medium severity, CVSS 6.8 | Vulnix