Arubaos Cx
CVE-2025-37160
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.
AnalysisAI
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data. Affected products include: Hpe Arubaos-Cx.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
More in Arubaos Cx
View allAuth bypass in HPE Aruba AOS-CX switch web management.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achie
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potent
Authenticated attackers can execute arbitrary OS commands on AOS-CX Switches through improper input validation in the CL
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticate
A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab
A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8),
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today