ArubaOS CVE-2025-37145

Exploitation requires an authenticated session with high privileges (PR:H) on the management interface of an affected AOS-10 Gateway or AOS-8 Controller/Mobility Conductor; the attacker then abuses a path-traversal flaw in a low-level interface library to download files outside the intended directory. No user interaction is needed (UI:N). The principal limiting factor is the PR:H requirement - the actor must already possess administrative/operator-level access to the device, which sharply narrows the realistic attacker population to insiders or those who have already compromised an admin account. Impact is confined to reading files (confidentiality); no write/integrity or availability impact applies.

This is a moderate-severity, lower-priority issue rather than an urgent threat. The CVSS 3.1 base score is 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - network-reachable and low-complexity, but critically gated behind PR:H, meaning the attacker must already hold high (administrative) privileges on the Aruba device. Impact is confidentiality-only (C:H, I:N, A:N): an authorized actor abusing a path-traversal flaw to read files they should not. The signals are consistent and point to low real-world urgency: EPSS is 0.45% (37th percentile), indicating low predicted exploitation likelihood; the CVE is NOT on the CISA KEV list; and no public exploit code was identified in the provided data. There is no conflict between the CVSS vector and the description - both agree on an authenticated actor. The main caveat is the high-privilege precondition: an attacker who already has administrative access to a network controller has substantial capability regardless of this specific flaw, which is likely why both CVSS and EPSS rate the real-world risk as modest. Prioritize via normal patch cycles rather than emergency response.

An authenticated administrative user of an AOS-10 Gateway or AOS-8 Controller/Mobility Conductor sends a carefully constructed request to the vulnerable low-level interface library, using path-traversal sequences to download arbitrary files from the underlying filesystem (e.g., configuration or credential material) beyond their intended scope. Because exploitation requires existing high-privilege access (PR:H) and the complexity is low (AC:L), it is realistic only where a malicious or compromised admin account exists. No public proof-of-concept was identified at time of analysis.