ArubaOS
CVE-2025-37140
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to ArubaOS CLI with privileges
-
ExploitCraft malicious file-download command
-
ExecutionAbuse CLI binary path handling
-
ImpactExfiltrate arbitrary sensitive files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already be an authenticated, high-privilege user of the ArubaOS CLI (PR:H) on an affected AOS-10 Gateway or AOS-8 Controller/Mobility Conductor, from which a carefully constructed CLI command abuses a file-download function to read arbitrary files. The primary limiting factor is this privileged authentication requirement - a low-privilege or unauthenticated actor cannot reach the vulnerable CLI binary; no user interaction and no special non-default configuration are indicated. |
| Impact | This is a moderate-severity, authenticated arbitrary file download flaw (CVSS 4.9, CWE-284) in the CLI binary of ArubaOS devices. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates network reachability and low complexity, but crucially requires high privileges (PR:H) - meaning the attacker must already be an authenticated administrative/privileged CLI user. Impact is confined to confidentiality (C:H) with no integrity or availability effect. The EPSS score of 0.35% (27th percentile) is low, the CVE is NOT in CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation. These signals are consistent with each other: low real-world exploitation probability gated behind a high-privilege prerequisite. This is a legitimate but lower-priority issue - a privileged user abusing CLI functions to read files they should not - rather than a mass-exploitable remote threat. Note a conflict in the input metadata: the 'Authentication Bypass' tag contradicts the description and CVSS PR:H, which both require an authenticated privileged actor; this appears to be a mislabel and should be verified against the HPE advisory. |
| Exploit ScenarioDerived | An authenticated attacker with privileged CLI access to an ArubaOS-10 gateway or AOS-8 Controller/Mobility Conductor crafts a malicious CLI command that abuses a file-download function to retrieve arbitrary files from the underlying filesystem, such as configuration or credential material. No public exploit code is identified at time of analysis, and the high-privilege requirement (PR:H) means the actor must already hold elevated access on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Arbitrary file download in the CLI binary of HPE Aruba Networking ArubaOS (AOS-10 Gateway and AOS-8 Controller/Mobility Conductor) lets an authenticated, high-privilege CLI user retrieve files outside the intended download scope by crafting a specially constructed command, exposing sensitive local files to the attacker. The flaw is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and classified as CWE-284 improper access control; impact is limited to confidentiality, with no integrity or availability effect. EPSS is only 0.35% (27th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the primary barrier to exploitation is the requirement for an already privileged authenticated CLI session.
RemediationAI
No exact fixed release version is provided in the available data, so patch status is not independently confirmed; administrators must consult the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US to identify the vendor-released firmware that resolves CVE-2025-37140 and upgrade AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors accordingly. Because exploitation requires an authenticated, high-privilege CLI user, the most effective compensating controls are to minimize and audit who holds privileged CLI accounts, enforce least privilege and role separation for ArubaOS management users, and immediately rotate credentials and review CLI command logs for anomalous download attempts if a privileged account is suspected of compromise. Reduce exposure by restricting management-plane access to a dedicated out-of-band VLAN or jump host, blocking CLI/SSH and web management ports from general user and internet-facing networks, and disabling any unused file-transfer or management services on the controller or gateway; each of these limits reachability but does not remove the underlying flaw, so they are interim measures only until vendor firmware is applied. There is no public exploit identified at time of analysis, which lowers - but does not eliminate - the urgency of the privileged-account hygiene measures above.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the command-line interface (CLI) binary shared across ArubaOS-based AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors, where a file-download function fails to enforce proper access control over the path or resource being requested. CWE-284 (Improper Access Control) describes the root cause: the CLI accepts attacker-influenced input that reaches a file-retrieval routine without adequate validation or authorization scoping, so a privileged operator can direct the download logic at files the interface was never intended to serve. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms the operation is network-reachable and low-complexity but requires high privileges, yields no user interaction, stays within a single security scope, and produces a high-confidentiality, read-only outcome. Available CPE data (cpe:2.3:o:arubanetworks:arubaos) uses wildcarded version fields, so exact affected builds cannot be resolved from CPE alone and must be taken from the HPE advisory. Because exploitation depends on legitimate CLI access rather than memory corruption or authentication bypass, the attack surface is the management/administrative interface of the affected devices.
Know when Arubaos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CLI is network-reachable (AV:N, AC:L) but requires privileged authentication (PR:H); impact is file disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthe
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthent
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that coul
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
GitHub PoC
Exploit-DB