ArubaOS CVE-2025-37144

Exploitation requires the attacker to already hold high-privilege/administrative access to the device's management interface (CVSS PR:H), and targets a specific low-level interface library present in AOS-10 Gateway and AOS-8 Controller/Mobility Conductor firmware. The limiting factors are significant: valid privileged credentials or an authenticated admin session are mandatory, there is no unauthenticated path, and impact is confined to confidentiality (reading arbitrary files) with no write/integrity or denial-of-service effect. No user interaction is needed once authenticated. Realistic risk is therefore largely bounded by how well management-plane access to these appliances is restricted.

This is a moderate-severity, high-CVSS-but-low-real-risk issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) signals a network-reachable, low-complexity attack but one gated behind PR:H - the attacker must already hold high (administrative) privileges on the ArubaOS device, which is a substantial barrier that caps the score despite full confidentiality impact (C:H). The EPSS score of 0.45% (37th percentile) indicates low predicted exploitation probability, consistent with the privilege requirement. It is not listed in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. The signals are internally consistent: a privileged-only file-disclosure bug with no integrity or availability impact and low EPSS does not warrant emergency patching, though it is a meaningful post-authentication information-disclosure risk on management-plane appliances and should be remediated in normal patch cycles. Note the CPE list repeats the same generic 'arubaos' entry five times with wildcard versions, so precise affected version ranges are not resolvable from the provided data and must be confirmed against the HPE advisory.

An attacker who has already obtained high-privilege (administrative) access to an AOS-10 Gateway or AOS-8 Controller/Mobility Conductor - for example via stolen or weak management credentials - sends a carefully constructed request to the vulnerable low-level interface library to traverse outside intended directories and download arbitrary files from the device, such as configuration or credential material. No public exploit code was identified at time of analysis, and exploitation is limited by the requirement for pre-existing privileged access.