CVE-2025-37162

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authentCVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintendedCVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet cCVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. SucceCVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could alloCVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the sameCVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 o