Aruba AOS CVE-2025-37148

Exploitation requires the attacker to be on an adjacent (layer-2) network segment to the Aruba device (CVSS AV:A), i.e., able to deliver raw ethernet frames to it, such as a rogue wireless client or a host on the same broadcast domain/VLAN - it is NOT exploitable from an arbitrary routed internet position despite the word 'remote' in the description. No authentication, user interaction, or special configuration is required (PR:N/UI:N/AC:L); default configurations of AOS-8 Instant and AOS 10 that parse ethernet frames are affected. The primary limiting factor is the adjacency requirement: networks that segregate untrusted clients from management/infrastructure segments substantially reduce exposure. Impact is confined to availability (service disruption potentially needing manual restoration); there is no confidentiality or integrity impact.

This is a medium-severity availability-only flaw (CVSS 6.5, A:H with C:N/I:N) whose signals point to a modest, non-urgent priority rather than a top-tier threat. The CVSS vector is AV:A/AC:L/PR:N/UI:N: low-complexity, unauthenticated, but adjacent-network - the attacker must have layer-2 adjacency (same broadcast domain/segment) rather than arbitrary internet reachability. NOTE A CONFLICT: the NVD description calls this an 'unauthenticated remote attacker,' while the CVSS vector specifies AV:A (adjacent), not AV:N (network); 'remote' here most likely means 'over the air / across the link layer' rather than routable-internet remote - verify blast radius with HPE Aruba. Exploitation-probability signals are low: EPSS is 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit code was identified. There is no SSVC decision data in the input. Taken together, this is a real but low-to-moderate priority: a CWE-400 resource-exhaustion DoS on enterprise Wi-Fi infrastructure that requires network adjacency and yields only service disruption (no data compromise), warranting patching on a normal maintenance cadence rather than emergency response, with higher priority for networks where untrusted devices share layer-2 segments with Aruba infrastructure.

An attacker with access to a network segment adjacent to an Aruba AOS-8 Instant or AOS 10 device (for example, a rogue client on the same VLAN or a compromised host on the wired segment) crafts and sends malformed ethernet frames that trigger the parsing defect. Because exploitation is unauthenticated and low-complexity (AV:A/AC:L/PR:N), the attacker can repeatedly disrupt network services, and recovery may require manual intervention to restore functionality. No public proof-of-concept exploit was identified at time of analysis.