ArubaOS CVE-2025-37135

Exploitation requires authenticated access to the command-line interface of an AOS-8 Controller or Mobility Conductor with high privileges (CVSS PR:H), meaning the attacker must already possess administrative/management credentials for the device. The attack surface is the management CLI, so exploitation is limited to actors who can reach the management plane over the network and authenticate to it. Key limiting factors: valid privileged credentials are mandatory (no unauthenticated path), and exposure is reduced where CLI/management access is restricted to isolated management networks or protected by MFA; there is no user-interaction requirement and no confidentiality impact (C:N).

Multiple signals converge on this being a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, I:H/A:H, C:N) correctly describes a network-reachable but high-privilege-gated flaw: the attacker must already hold administrative/privileged CLI access on the AOS-8 Controller or Mobility Conductor, which sharply limits the pool of realistic attackers to insiders or those who have already compromised privileged credentials. EPSS reinforces low urgency at 0.36% (28th percentile), indicating low modeled exploitation probability. There is no CISA KEV listing and no public proof-of-concept referenced, so this is not confirmed to be under active exploitation. The PR:H requirement and absence of confidentiality impact mean the practical outcome is integrity/availability damage (file deletion leading to disruption) by an already-privileged actor rather than a remote takeover primitive. One conflict to note: the input Tags include 'Authentication Bypass,' which contradicts both the description ('authenticated remote malicious actor') and the CVSS PR:H metric - this vulnerability requires authentication and is not an auth bypass; treat that tag as erroneous. Net: a legitimate patch-worthy issue for exposed management planes, but not an emergency relative to unauthenticated RCE-class bugs.

An attacker who has obtained privileged administrative credentials for an AOS-8 Controller or Mobility Conductor (e.g., via credential theft, a reused password, or a malicious insider) logs into the management CLI over the network. Using the vulnerable command, they delete arbitrary files on the underlying system, corrupting configuration or system files to disrupt wireless infrastructure availability. No public exploit code is referenced, and successful exploitation requires valid high-privilege access.