HPE ArubaOS-CX CVE-2025-37157

Exploitation requires the attacker to already hold valid authenticated access to the ArubaOS-CX device (PR:L) and reach a management interface (CLI, REST/web, or similar) exposed over the network; the flaw is command injection (CWE-94) where attacker-supplied input reaches an OS command. The input data does not name the exact vulnerable feature, command, or configuration mode, so the precise trigger cannot be stated from available data - this should be verified against HPE advisory hpesbnw04888en_us. Limiting factors that reduce real-world risk: valid credentials are mandatory (no unauthenticated path), and management-plane access to switches is typically restricted to isolated/out-of-band management networks in well-configured environments, narrowing the realistic attacker population to insiders or those who have already breached the management network.

This is a genuine but conditional risk rather than an emergency. The CVSS 3.1 base score of 8.8 is driven by network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and full CIA impact (C:H/I:H/A:H), but it explicitly requires privileges (PR:L) - so an attacker must already be an authenticated user on the device. The multi-source signals converge toward lower real-world urgency: EPSS is only 0.13% (32nd percentile), indicating a low modeled probability of exploitation in the near term; there is no CISA KEV listing and no public proof-of-concept referenced, meaning no public exploit identified at time of analysis. No SSVC decision data was provided in the input. The signals are internally consistent - a high-impact-but-authentication-gated flaw in networking infrastructure that has not yet attracted public exploitation. The main caveat is that the single reference is a vendor advisory behind an HPE support portal that could not be inspected here, so affected version ranges and patch details are not independently confirmed; the five CPE entries are all wildcard 'arubaos-cx:*' strings and carry no version boundaries, so the precise vulnerable range is unknown from this data.

An attacker who has obtained valid low-privilege credentials on an ArubaOS-CX switch (for example via phishing, credential reuse, or a compromised management account) sends crafted input to a CLI or management interface field that is passed unsanitized to a system command, injecting operating-system commands that execute on the switch. This yields remote code execution with the resulting privileges and full compromise of the device's confidentiality, integrity, and availability. No public exploit code is referenced, so an attacker would need to develop the exploit independently.