ArubaOS CVE-2025-37142

Requires an authenticated session on the CLI of an affected Aruba device with high privileges (CVSS PR:H) - i.e., valid operator/admin-level CLI access to an AOS-10 Gateway or AOS-8 Controller/Mobility Conductor. The exploit is delivered as a specially constructed CLI command/argument to the vulnerable CLI binary. Limiting factors: the PR:H precondition means an attacker must already possess privileged CLI credentials or management access, substantially reducing the exploitable population; impact is confined to reading arbitrary files (no integrity or availability impact). No special non-default configuration is called out in the description beyond having CLI/management access enabled.

This is a high-CVSS-but-moderate-real-risk issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) is internally consistent with the description: exploitation is network-reachable but gated behind high privileges (PR:H), meaning the attacker must already be an authenticated, high-privilege operator of the CLI. Impact is confidentiality-only (C:H, I:N, A:N) - arbitrary file disclosure, not code execution or tampering. EPSS is low at 0.35% (27th percentile), consistent with the high-privilege precondition that sharply narrows the realistic attacker population. There is no CISA KEV listing and no public exploit identified in the provided data, so this is not an urgent, actively-exploited priority. The main caveat: the tag 'Authentication Bypass' directly contradicts the PR:H vector and the description's 'authenticated malicious actor' language - this is an authorization/improper-access-control flaw (CWE-284) for an already-authenticated user, NOT an authentication bypass; treat that tag as erroneous. Net: a legitimate patch-management item for Aruba-estate operators (file disclosure could expose configs, keys, or credential material and enable privilege escalation or lateral movement), but not a drop-everything emergency given the PR:H gate and absence of exploitation signals.

An authenticated administrator or an attacker who has already obtained high-privilege CLI credentials (e.g., via phishing, credential reuse, or an insider) connects to the management CLI of an affected Aruba controller and issues a specially crafted command that coerces the CLI binary into returning the contents of an arbitrary file outside the intended scope. This could expose sensitive configuration, key material, or stored credentials usable for further escalation or lateral movement. No public proof-of-concept was identified in the provided data.