CVE-2025-37158

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371597.3A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to CVE-2025-37165.3User enumeration in ESET Protect (on-prem) via Response Timing.CVE-2025-371606.5A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low priv CVE-2025-371617.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial CVE-2025-371628.8A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injectio CVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authent CVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet c CVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Succe CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo CVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same