HPE ArubaOS CVE-2025-37138
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to controller
-
DeliveryAuthenticate to CLI as privileged user
-
ExploitInject shell metacharacters into CLI command
-
ExecutionEscape restricted interpreter
-
ImpactExecute arbitrary OS commands as privileged user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires BOTH physical access to the controller hardware (console/serial or local management port of an AOS-10 gateway or AOS-8 Controller/Mobility Conductor) AND authenticated high-privilege access to the command-line interface binary. The attack is a command-injection escape from the restricted CLI into the underlying OS via a vulnerable command argument. Limiting factors are significant: no remote or network exploitation is possible (AV:P), the attacker must already hold privileged CLI credentials (PR:H), and the target is the on-box CLI rather than any exposed network service, so standard physical security of the appliance (locked racks/comms rooms) substantially mitigates realistic risk. |
| Impact | Real-world risk is LOW despite the HIGH technical impact (C:H/I:H/A:H), because the CVSS vector is gated by two strong preconditions: AV:P (physical access to the controller hardware) and PR:H (high-privilege authenticated access to the CLI). An attacker who already has physical possession of, and privileged credentials on, an Aruba controller is largely in a position of trust already; this flaw lets them pivot from the restricted CLI to arbitrary OS command execution as a privileged user - a sandbox/CLI-escape escalation rather than a remote compromise. EPSS is 0.66% (50th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code is identified, so there is no indication of active or widespread exploitation. The signals are internally consistent: a modest base score (6.2), a middling EPSS, and no KEV/POC all point to a low-urgency, defense-in-depth issue rather than an emergency. No key data is missing or conflicting - the physical-access requirement stated in the description matches AV:P in the vector. |
| Exploit ScenarioDerived | An insider or attacker with physical access to an Aruba AOS-10 gateway or AOS-8 controller logs into the console CLI with privileged credentials and injects shell metacharacters into a vulnerable CLI command argument, breaking out of the restricted command interpreter. The injected payload runs as a privileged user on the underlying OS, giving full control of the appliance. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated command injection in the command-line interface binary of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors lets an attacker who already holds high-privilege CLI credentials and has physical access to the appliance hardware escape the restricted CLI and execute arbitrary commands as a privileged user on the underlying operating system. The flaw carries a CVSS v3.1 score of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so although confidentiality, integrity and availability impact is rated High, the vector is gated by two strong preconditions - physical access to the controller hardware (AV:P) and high-privilege authenticated access to the CLI (PR:H) - keeping real-world risk low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.66% (50th percentile), consistent with a vulnerability that cannot be reached remotely.
RemediationAI
Apply the ArubaOS maintenance release identified in the HPE security bulletin (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US); this is a vendor advisory for an on-box CLI defect, and the exact fixed AOS-10 Gateway and AOS-8 Controller/Mobility Conductor versions are listed there rather than in the available data, so treat the advisory as the source of truth. Because the vulnerability cannot be reached remotely and requires privileged CLI credentials plus physical presence, the highest-value compensating controls are physical and identity-based: keep controllers in locked racks and access-controlled communications rooms, log and review physical access to console/serial and local management ports, and reduce the pool of accounts that hold privileged CLI roles by using TACACS+/RADIUS with least-privilege role assignment instead of local administrator accounts (side effect: loss of local fallback access if the AAA server is unreachable, so retain one break-glass credential in a sealed store). Enable CLI command accounting and ship ArubaOS audit/syslog records to a central collector to detect abnormal command arguments or shell escapes (side effect: increased log volume and a dependency on syslog reachability); if a patched release cannot be deployed immediately, restricting privileged CLI login to a small set of vetted operators and enforcing session timeouts limits the window and the number of actors able to trigger the injection.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-77, improper neutralization of special elements used in a command ('command injection'), inside the CLI binary of ArubaOS. The on-box CLI presents a restricted, role-gated command interpreter; a vulnerable command argument is passed to the underlying shell without adequate sanitization or argument escaping, so a high-privilege CLI user can inject shell metacharacters and break out of the restricted interpreter into the controller's host operating system. The same binary and injection pattern affects two product families, the AOS-10 gateway line and the AOS-8 Controller/Mobility Conductor line, as reflected by the five affected CPE entries under cpe:2.3:o:arubanetworks:arubaos. Critically, this is an on-box CLI escape rather than a flaw in an exposed network service: exploitation requires the attacker to be sitting at the physical console, serial or local management interface with valid privileged credentials already in hand, which is why the assessed vector is AV:P/PR:H despite the High C/I/A ratings. The affected surface is therefore the local privilege boundary between the managed CLI and the underlying OS, not the controller's remote management or wireless control plane.
Know when Arubaos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Physical access to the hardware forces AV:P and privileged CLI credentials force PR:H; CLI-to-OS command injection yields full C/I/A on the same appliance (S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthe
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthent
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that coul
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
GitHub PoC
Exploit-DB