Aruba AOS-8 CVE-2025-37137

Exploitation requires the attacker to already be authenticated to the AOS-8 Controller / Mobility Conductor command-line interface with high (administrative) privileges, consistent with CVSS PR:H. The attack surface is the CLI's file-handling commands, which fail to properly restrict which files may be deleted (CWE-284). Limiting factors: the requirement for valid high-privilege management credentials sharply narrows the realistic attacker set to insiders or those who have already compromised an admin account, and exposure is further reduced where the management interface is restricted to trusted administrative networks rather than broadly reachable.

This is a moderate-severity, authenticated integrity/availability issue rather than a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base 6.5) tells a consistent story: network-reachable CLI, low attack complexity, but PR:H means the attacker must already hold high (administrative) privileges, which substantially raises the bar. The low EPSS score (0.36%, 28th percentile) aligns with the lack of CISA KEV listing and no identified public exploit - there is no signal of active or imminent exploitation. The main caveat is that a PR:H arbitrary-file-deletion flaw primarily matters as a post-authentication privilege-consolidation or anti-forensics/destruction capability; it is not a remote-unauthenticated compromise. The CWE-284 (Improper Access Control) classification plus the description ('authenticated remote malicious actor') and PR:H are mutually consistent, so no major conflicts exist. One metadata conflict: the input Tags include 'Authentication Bypass,' which contradicts the description (this is exploitation BY an already-authenticated actor, not a bypass) and the PR:H vector - treat that tag as likely mislabeled.

An attacker who has already obtained authenticated administrative access to an AOS-8 Controller or Mobility Conductor (e.g., via stolen/weak operator credentials or an abused management account) logs into the command-line interface and issues a crafted command that deletes arbitrary files on the underlying system. This could be used to remove critical configuration or system files to cause outage or destroy logs. No public proof-of-concept is identified at time of analysis.