ArubaOS CVE-2025-37143

Exploitation requires an already-authenticated malicious actor with high-privilege (administrative, PR:H) access to the web-based management interface of AOS-10 GW or AOS-8 Controller/Mobility Conductor; the attacker then submits a specially crafted request to the file-download function to retrieve arbitrary files. Key limiting factors: valid high-privilege management credentials must be obtained first, the management interface must be reachable by the attacker (network-accessible but typically restricted to management networks in hardened deployments), and no user interaction by a victim is involved. There is no indication of a special non-default feature toggle - the flaw is in the standard web management download handling.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score is 4.9 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N shows the single most important limiting factor: PR:H means the attacker must already hold high-privilege (administrative) authenticated access to the web management interface before exploitation is possible. Impact is confidentiality-only (C:H/I:N/A:N) - file disclosure, no integrity or availability loss. The EPSS score of 0.38% (30th percentile) is low, indicating no significant observed or predicted exploitation activity. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. No SSVC decision data was supplied. Signals are internally consistent rather than conflicting: low EPSS, no KEV, no POC, and a high privilege requirement all point to a low real-world risk despite the C:H impact rating. The one notable discrepancy is in the input metadata - the 'Authentication Bypass' tag conflicts with both CWE-284 (Improper Access Control) and the description, which explicitly requires an already-authenticated actor; this is an arbitrary file download by an authenticated user, not an authentication bypass. Treat this as a defense-in-depth patch for privileged-insider or post-compromise scenarios rather than an urgent perimeter emergency.

An attacker who has already obtained high-privilege administrative credentials to an Aruba controller's web management interface (for example a rogue admin, or an outsider who phished or reused valid admin credentials) sends a carefully constructed request to the file-download functionality. Because access controls on the download path are improperly enforced (CWE-284), the attacker retrieves arbitrary files from the underlying system, potentially exposing configuration, secrets, or certificates. No public exploit code was identified at the time of analysis, and exploitation requires pre-existing privileged authentication, limiting realistic attackers.