CVE-2025-37146

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-371477.1A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verificati CVE-2025-371486.5A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a de CVE-2025-371496.0A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware.CVE-2025-37156.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, a CVE-2025-371557.8A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated re CVE-2025-371566.8A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could al CVE-2025-371578.8A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacke CVE-2025-371588.8A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacke CVE-2025-371597.3A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to CVE-2025-37165.3User enumeration in ESET Protect (on-prem) via Response Timing.CVE-2025-371606.5A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low priv CVE-2025-371617.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial