ArubaOS CVE-2025-37136

Exploitation requires the attacker to already possess high-privilege (administrative) access to the command-line interface of an Aruba AOS-8 Controller or Mobility Conductor, as reflected by PR:H in the CVSS vector and the description's 'authenticated remote malicious actor.' No user interaction is needed (UI:N) and the CLI is reachable over the network (AV:N). The primary limiting factor is the administrative authentication requirement - this cannot be triggered by an unauthenticated or low-privilege user - which confines realistic exploitation to compromised admin accounts, malicious insiders, or chaining from a separate privilege-escalation flaw. No non-default configuration is called out in the description.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) reflects a network-reachable, low-complexity attack but one gated behind PR:H - the attacker must already hold high (administrative) privileges on the AOS-8 Controller/Mobility Conductor CLI, which substantially constrains who can exploit it. Impact is limited to integrity and availability (arbitrary file deletion); there is no confidentiality impact (C:N). The EPSS score of 0.36% (28th percentile) indicates low predicted exploitation probability, consistent with the privilege barrier. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. One conflict to note: the input Tags include 'Authentication Bypass,' which contradicts both the description ('authenticated remote malicious actor') and the CVSS vector (PR:H) - this CVE is a privileged file-deletion flaw, not an authentication bypass, and the tag appears mislabeled. Overall, the realistic risk is post-authentication privilege abuse / insider or chained-attack scenario, not mass unauthenticated exploitation.

An attacker who has already obtained administrative CLI credentials on an Aruba AOS-8 Controller or Mobility Conductor (via phishing, credential reuse, or as a malicious insider) connects remotely and issues a crafted CLI command that deletes arbitrary files on the underlying system. By removing critical configuration, logging, or system files, the attacker degrades controller availability or erases forensic evidence. No public proof-of-concept exploit has been identified at time of analysis.