CVE-2025-37168

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	ArubaOS (AOS)	>= 8.12.0.0, <= 8.13.1.0; >= 8.10.0.0, <= 8.10.0.20

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04987en_us&docLocale=en_USVendor Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-371697.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allo CVE-2025-37172.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same CVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating s CVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 o CVE-2025-371757.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 opera CVE-2025-371767.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, poten CVE-2025-371776.5An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or A CVE-2025-371787.5Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insu CVE-2025-371795.3Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insu