ArubaOS CVE-2025-37133

Exploitation requires the attacker to already hold a privileged (administrator-level) authenticated CLI account on an AOS-8 Controller or Mobility Conductor; the flaw is command injection (CWE-77) in the CLI binary, so a valid privileged session reachable over the network is the core prerequisite. The limiting factor is the PR:H privilege level - this is not reachable by unauthenticated or low-privilege users, which confines realistic abuse to compromised admin credentials or malicious insiders. No user interaction by a victim is required (UI:N). The unversioned wildcard CPEs mean defenders must confirm which specific AOS-8 release trains are affected via the HPE advisory.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) indicates network-reachable, low-complexity exploitation but requires HIGH privileges (PR:H), meaning the attacker must already hold a privileged/administrative CLI account on the AOS-8 Controller or Mobility Conductor. This privilege prerequisite substantially lowers real-world risk and reframes the flaw primarily as a privilege-escalation / sandbox-escape path (CLI-restricted admin to full underlying-OS command execution) rather than a path for anonymous compromise. Supporting signals align: EPSS is 1.23% (68th percentile) - low absolute exploitation probability consistent with an auth-gated bug; the CVE is NOT on CISA KEV; and no public POC is referenced. No signals conflict - the low EPSS, absence of KEV, and high-privilege requirement all point the same direction. The impact if exploited is severe (C:H/I:H/A:H - full OS-level code execution on network infrastructure), so the flaw matters for defense-in-depth, but the combination of required privileged access plus no evidence of exploitation makes it a patch-in-normal-cycle item, not an active-threat emergency.

An attacker who has already obtained privileged administrative CLI credentials (for example via phishing, credential reuse, or an insider) logs into the AOS-8 Controller/Mobility Conductor management interface and injects crafted shell metacharacters into a vulnerable CLI command argument, breaking out of the restricted CLI to run arbitrary commands as a privileged user on the underlying operating system. No public exploit code is referenced; exploitation requires valid high-privilege authentication, so this is realistically a post-compromise escalation or malicious-insider scenario.