ArubaOS CVE-2025-37132

Exploitation requires the attacker to be authenticated to the ArubaOS web-based management interface with high (administrative) privileges, per CVSS PR:H - this is not a pre-auth flaw. The specific prerequisite is access to the file-upload functionality within that management interface on an AOS-10 Gateway or AOS-8 Controller/Mobility Conductor. Limiting factors that reduce real-world risk: the required administrative authentication level, and the fact that the management interface should not be exposed to untrusted networks in hardened deployments; where the management plane is restricted to a dedicated/trusted network segment, the network attack vector is effectively constrained to that segment.

This is a moderate-priority issue rather than an urgent one, and the signals are consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) shows the flaw is reachable over the network with low complexity and no user interaction, but it explicitly requires HIGH privileges (PR:H) - meaning an already-authenticated administrative actor on the web management interface. That authentication barrier is the dominant limiting factor and sharply narrows the realistic attacker population to insiders or those who have already compromised admin credentials. EPSS corroborates the lower urgency at 0.55% (44th percentile), i.e. a low near-term probability of broad exploitation. The vulnerability is NOT listed in CISA KEV and no public exploit code is identified in the provided data, so there is no evidence of active exploitation. The confidentiality, integrity and availability impacts are all HIGH because successful exploitation yields arbitrary command execution on the underlying OS, so while the barrier to entry is high, the consequence of a successful attack is severe (full controller compromise). No conflicting signals were found: network vector, HIGH privilege requirement, low EPSS and absence of KEV/POC all point the same direction - a serious post-authentication flaw that should be patched on a normal prioritized cadence rather than treated as an emergency.

An actor who already holds administrative credentials (or has hijacked an admin session) on the ArubaOS web-based management interface uploads a crafted file through the vulnerable upload function, writing it to an attacker-chosen location and leveraging it to run arbitrary commands on the controller's underlying OS. No public proof-of-concept is identified in the provided data. The network-reachable, low-complexity interface makes exploitation straightforward once the required high privileges are obtained.