ArubaOS-CX CVE-2025-37158

Exploitation requires the attacker to first possess valid authenticated access to the ArubaOS-CX management plane (PR:L), such as a low-privilege operator or management account, and network reachability to the switch management interface (AV:N). The core condition is the ability to supply attacker-controlled input to a management function (CLI/API parameter) that passes it to an OS shell command (CWE-78). No user interaction by a victim is required (UI:N). The principal limiting factor is the authentication requirement: devices whose management interfaces are restricted to trusted administrators on isolated/out-of-band management networks have a much smaller realistic attack surface. The description does not name a specific non-default feature or configuration mode as a precondition, so exploitability appears to apply to standard management access rather than an opt-in feature.

This is a credible mid-to-high priority issue but not an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation with full CIA impact, but critically requires low privileges (PR:L) - meaning an authenticated session on the AOS-CX device is a hard prerequisite, which substantially reduces the exposure compared to an unauthenticated RCE. The real-world exploitation signals are modest and consistent with each other: EPSS is 0.13% (32nd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. These low-probability signals contrast with the high 8.8 base score, which is driven by impact (RCE) rather than by ease or likelihood of opportunistic mass exploitation. The dependence on prior authentication is the key mitigating factor: this is best characterized as a privilege-escalation-to-RCE risk from an already-authenticated foothold (e.g., a compromised operator credential or a lower-privileged management account) rather than a wormable perimeter flaw. No signals conflict; all available evidence points to a vendor-reported, patch-oriented vulnerability with low current exploitation activity.

An attacker who already holds valid (even low-privilege) management credentials for an ArubaOS-CX switch submits crafted input to a CLI or management interface parameter that is passed unsafely to an underlying OS command, injecting attacker-controlled commands. This yields remote code execution on the switch operating system, enabling full compromise of the device. No public proof-of-concept exploit was identified at time of analysis, and exploitation requires an authenticated session.