« Volver al listado

CVE-2025-27078

Estado: AplazadaMedia (6.5)—

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Aruba — Aos-10 APAIAruba — Aos-8 InstantAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27078",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27078",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-09T04:00:48.029992Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@hpe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "product": "AOS-10 AP",
          "versions": [
            {
              "status": "affected",
              "version": "10.7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.7.0.1"
            },
            {
              "status": "affected",
              "version": "10.4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.4.1.5"
            },
            {
              "status": "affected",
              "version": "8.12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.12.0.3"
            },
            {
              "status": "affected",
              "version": "8.10.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.10.0.15"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-08T16:15:25.683",
  "references": [
    {
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04844en_us&docLocale=en_US",
      "source": "security-alert@hpe.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en un binario del sistema de AOS-8 Instant y AOS-10 AP podría permitir que un atacante remoto autenticado inyecte comandos en el sistema operativo subyacente mientras usa la CLI. Una explotación exitosa podría comprometer completamente el sistema."
    }
  ],
  "lastModified": "2026-06-17T09:02:59.477",
  "sourceIdentifier": "security-alert@hpe.com"
}