ArubaOS
CVE-2025-37141
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to device CLI with high privileges
-
ExploitCraft malicious file-path CLI command
-
ExecutionTrigger arbitrary file download in binary
-
ImpactExfiltrate sensitive configuration or secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the CLI binary of an Aruba AOS-10 Gateway or AOS-8 Controller/Mobility Conductor with HIGH privileges (PR:H) - i.e., administrative or equivalently elevated CLI access - after which a carefully constructed command abuses the binary's file-path handling to download arbitrary files. The limiting factor is this high privilege prerequisite: an unprivileged or unauthenticated network attacker cannot reach the vulnerable function, which is why the CVSS score is only 4.9 despite network reachability. No end-user interaction is required (UI:N), and impact is limited to confidentiality (file disclosure) with no integrity or availability effect. |
| Impact | This is a moderate-severity (CVSS 4.9) arbitrary file download flaw (CWE-284, improper access control) confirmed by the vendor HPE/Aruba. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) tells a consistent story with the description: network-reachable but requiring HIGH privileges (PR:H), meaning the attacker must already hold administrative/high-level CLI access before exploitation. Signals are mutually reinforcing rather than conflicting: EPSS is low (0.35%, 27th percentile), there is no CISA KEV listing and no public exploit identified, and the impact is confidentiality-only (C:H, I:N, A:N). No SSVC decision data was supplied. Net assessment: this is NOT a top-tier emergency patch - the PR:H requirement sharply limits the attacker population to already-privileged users, so real-world risk is best characterized as a privilege-escalation/post-compromise data-exposure concern (e.g., a low-trust admin reading files outside their intended scope) rather than a remote unauthenticated takeover. One labeling caveat: the input Tags include 'Authentication Bypass', which contradicts the CVSS PR:H and the CWE-284 'arbitrary file download' description - this appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An authenticated malicious actor with high-level CLI access to an Aruba AOS-10 gateway or AOS-8 controller/Mobility Conductor crafts a malformed CLI command that abuses the binary's file-handling to download files outside its intended scope, exfiltrating sensitive configuration or credential material. No public exploit code has been identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once the required privileges are held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated high-privilege CLI users on Aruba AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors can abuse the CLI binary's file-path handling to download arbitrary files from the underlying operating system, exposing configuration, credential, and key material to an actor who already holds elevated administrative access. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and classified as CWE-284 improper access control, with impact limited to confidentiality because the attacker must first reach the CLI with HIGH privileges, and no integrity or availability effect is possible. No public exploit code has been identified at time of analysis and EPSS estimates a low 0.35% (27th percentile) probability of exploitation in the next 30 days, so this ranks as a moderate-severity hardening issue rather than an emergency patch.
RemediationAI
No exact fixed version is specified in the available intelligence; the authoritative fix guidance is the HPE/Aruba security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US, which should be consulted to identify and install the patched AOS-10 and AOS-8 releases, as patch status beyond that advisory is not confirmed by the supplied data. Because the attack requires a pre-existing high-privilege CLI session, the highest-value compensating controls are access and privilege reduction: restrict CLI/SSH and management-plane reachability to a dedicated out-of-band management VLAN with strict ACLs or firewall rules (trade-off: administrators lose convenient in-band management and must maintain separate jump-host access), enforce least privilege by eliminating shared admin accounts and enabling MFA or TACACS+/RADIUS role separation so that only a minimal set of operators hold the HIGH privileges needed to reach the vulnerable function (trade-off: added authentication friction and dependency on the AAA server). Detect and deter abuse by shipping CLI command output and audit logs to a central SIEM with alerting on anomalous file-transfer or unexpected path arguments in privileged sessions (trade-off: log volume and possible privacy considerations), and assume any file readable by a compromised admin account may have been exfiltrated, making credential/certificate rotation and configuration review prudent follow-ups. A full firmware upgrade remains the only complete fix since compensating controls cannot close the underlying path-validation defect.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the command-line interface binary shipped in ArubaOS, the network operating system that powers Aruba AOS-10 Gateways and AOS-8 Controllers and Mobility Conductors (CPE cpe:2.3:o:arubanetworks:arubaos). CWE-284 (Improper Access Control) describes the root cause: the CLI's file-handling routine does not properly constrain which filesystem paths a given privileged session may read, allowing a carefully constructed command to retrieve files outside the intended operational scope. Because the vector is AV:N/AC:L/PR:H/UI:N, the interface is network-reachable and exploitable without user interaction, but the PR:H metric means the attacker must already possess administrative or equivalent elevated CLI credentials - the access-control check that fails is one of path/role scoping rather than authentication itself, which is why the vendor-reported tag set includes authentication-bypass terminology but the authoritative assessment still requires an authenticated high-privilege session. Confidentiality is fully impacted (C:H) since arbitrary file reads can surface running configurations, PSK/credential stores, certificates and private keys, while integrity and availability are untouched (I:N/A:N), keeping the overall score at 4.9. This class of read-any-file primitive is most dangerous as a post-compromise escalation and lateral-movement aid rather than as an initial entry vector.
Know when Arubaos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CLI is network-reachable (AV:N) but gated behind high-privilege admin access (PR:H), exploitation is straightforward (AC:L), and the flaw only discloses files (C:H, I:N, A:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthe
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated R
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthent
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that coul
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenti
GitHub PoC
Exploit-DB