CVE-2025-37163

HighCVSS 7.2/10Last modified Oct 18, 2026

Description

A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371649.8A remote code execution issue exists in HPE OneView.CVE-2025-371657.5A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet c CVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Succe CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo CVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same CVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 o CVE-2025-371757.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 opera