CVE-2025-37162

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networking 100 Series Cellular Bridge	>= 10.7.0.0, <= 10.7.1.1

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04970en_us&docLocale=en_USVendor Advisory

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371637.2A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authent CVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet c CVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Succe CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo CVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same CVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 o