CVE-2025-37157

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-78

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networkign AOS-CX	>= 10.16.0000, <= 10.16.1000; >= 10.15.0000, <= 10.15.1020; >= 10.14.0000, <= 10.14.1050; >= 10.13.0000, <= 10.13.1090; >= 10.10.0000, <= 10.10.1160

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_USVendor Advisory

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371588.8A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacke CVE-2025-371597.3A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to CVE-2025-37165.3User enumeration in ESET Protect (on-prem) via Response Timing.CVE-2025-371606.5A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low priv CVE-2025-371617.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial CVE-2025-371628.8A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injectio CVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authent CVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet c CVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Succe CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo