ArubaOS CVE-2025-37162

Exploitation requires network reachability to the ArubaOS command line interface (management plane) AND valid authenticated credentials at low privilege level (PR:L) - an unauthenticated attacker cannot exploit this. The limiting factors are therefore: (1) the attacker must already possess or obtain a valid CLI account, and (2) the CLI/management interface must be reachable from the attacker's network position. Risk is significantly reduced where management interfaces are restricted to isolated management VLANs or jump hosts and where strong, non-default CLI credentials are enforced; it is elevated where the management CLI is exposed to broad internal or external networks.

This is a credible operational priority for organizations running Aruba/HPE wireless infrastructure, though not an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable command injection that requires only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact on the underlying OS. Countervailing signals temper urgency: the vulnerability is NOT in CISA KEV (no confirmed active exploitation), EPSS is only 0.10% (28th percentile, i.e. low modeled near-term exploitation probability), and no public exploit code was identified. The main caveat is the PR:L requirement - an attacker must first hold valid CLI credentials (even low-privilege operator access), which materially limits the pool of attackers versus an unauthenticated flaw; the high CVSS is driven by impact and ease once authenticated, not by trivial anonymous access. Net: patch on a normal-to-expedited enterprise cycle, prioritizing internet- or untrusted-network-exposed management interfaces, but there is currently no evidence of exploitation in the wild.

An attacker who has obtained valid low-privilege CLI credentials (e.g. a compromised operator account or weak/default management login) connects to the management interface of an affected ArubaOS device and submits a crafted command containing injected shell metacharacters. The CLI passes the input to the underlying OS, executing arbitrary commands with the privileges of the CLI process and potentially leading to full device compromise. No public proof-of-concept exploit was identified at the time of analysis.