ArubaOS CVE-2025-37134

Exploitation requires the attacker to already possess a privileged administrative account on the AOS-8 Controller or Mobility Conductor CLI (reflected as PR:H in the CVSS vector) and network reachability to the management CLI interface (e.g., SSH/console over the network). The specific trigger is the CLI binary passing unsanitized command arguments to the underlying OS, enabling shell metacharacter injection. The principal limiting factors are: valid privileged credentials are mandatory (no anonymous or low-privilege path), no user interaction is needed, and exposure is reduced where the management plane is restricted to a trusted admin network rather than reachable from untrusted segments.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) shows the flaw is network-reachable with low attack complexity, but critically requires PR:H - the attacker must already hold a privileged administrative account on the AOS-8 Controller/Mobility Conductor CLI. This high-privilege precondition is the dominant mitigating factor and is what keeps the score at HIGH rather than CRITICAL. EPSS of 1.23% (68th percentile) indicates low-to-moderate predicted exploitation probability, consistent with a flaw that is not trivially mass-exploitable because it is post-authentication. There is no CISA KEV listing and no public exploit code identified in the provided data, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input, so automatable/exploitation/technical-impact scoring cannot be stated. Signals are internally consistent: the high EPSS percentile is not contradicted by any KEV/POC evidence, and all point to a privilege-escalation/post-auth command-execution risk (a privileged admin breaking out of the CLI to the underlying OS) rather than a remote-unauthenticated breach. Verify affected version ranges directly with HPE/Aruba, as the CPE strings provide no version boundaries.

An attacker who has already obtained privileged administrative credentials to the ArubaOS CLI (via phishing, credential reuse, or an insider) logs into the controller over the network and submits a crafted CLI argument containing shell metacharacters. The injected input is passed unsafely to the underlying operating system, allowing arbitrary command execution as a privileged OS user and full compromise of the controller. No public proof-of-concept exploit was identified in the provided data.