26
CVEs
1
Critical
13
High
0
KEV
0
PoC
14
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
13
MEDIUM
12
LOW
0
Monthly CVE Trend
Affected Products (30)
Arubaos
179
Clearpass Policy Manager
123
Sd Wan
62
Scalance W1750D Firmware
48
Instantos
46
Clearpass
34
Airwave
30
Edgeconnect Sd Wan Orchestrator
29
Instant
28
Edgeconnect Enterprise
25
Aos Cx
12
Airwave Glass
8
Aruba Instant
6
Fabric Composer
5
Aruba Edgeconnect Enterprise Orchestrator
3
Aos Cx Firmware
3
Cx 6300 Firmware
2
2530 Firmware
2
5412R Firmware
2
3810M Firmware
2
5406R Firmware
2
2930M Firmware
2
2540 Firmware
2
2620 Firmware
2
Cx 6200F Firmware
2
2920 Firmware
2
2915 Firmware
2
Cx 8325 Firmware
2
Cx 6400 Firmware
2
Debian Linux
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-37184 | An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor authentication. This undermines the security of the entire authentication system. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2025-37168 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH] | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2025-37173 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37181 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37182 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37183 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37170 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37171 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37172 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37169 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37175 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH] | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37174 | Arubaos contains a vulnerability that allows attackers to an authenticated malicious actor to create or modify arbitrary files and execute (CVSS 7.2). | HIGH | 7.2 | 0.1% | 36 |
No patch
|
| CVE-2025-37177 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM] | MEDIUM | 6.5 | 0.1% | 33 |
No patch
|
| CVE-2025-37176 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. [CVSS 6.5 MEDIUM] | MEDIUM | 6.5 | 0.1% | 33 |
No patch
|
| CVE-2025-37185 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. [CVSS 5.5 MEDIUM] | MEDIUM | 5.5 | 0.0% | 28 |
No patch
|