CVE-2025-37165

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gain knowledge of internal network configuration details through inspecting impacted packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-371667.5A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet cCVE-2025-371689.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. SucceCVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could alloCVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the sameCVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 oCVE-2025-371757.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operaCVE-2025-371767.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potenCVE-2025-371776.5An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or A
CVE-2025-37165: High severity, CVSS 7.5 | Vulnix