« Volver al listado

CVE-2025-37138

Estado: AnalizadaMedia (6.2)—

An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Arubaos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-37138",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-37138",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-14T19:24:23.567629Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@hpe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "product": "ArubaOS (AOS)",
          "versions": [
            {
              "status": "affected",
              "version": "10.7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.7.1.1"
            },
            {
              "status": "affected",
              "version": "10.4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.4.1.8"
            },
            {
              "status": "affected",
              "version": "8.13.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.13.0.1"
            },
            {
              "status": "affected",
              "version": "8.12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.12.0.5"
            },
            {
              "status": "affected",
              "version": "8.10.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.10.0.18"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-10-14T17:15:40.557",
  "references": [
    {
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos autenticada existe en el binario de la interfaz de línea de comandos del sistema operativo AOS-10 GW y AOS-8 Controllers/Mobility Conductor. La explotación de esta vulnerabilidad requiere acceso físico a los controladores de hardware. Un ataque exitoso podría permitir a un actor malicioso autenticado con acceso físico ejecutar comandos arbitrarios como un usuario privilegiado en el sistema operativo subyacente."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D5F48C7-AD51-4641-9CBA-9DE9B516819E",
              "versionEndExcluding": "8.10.0.19",
              "versionStartIncluding": "8.10.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "057AA8F5-FF66-44E9-8E06-D2B9E8B91AD2",
              "versionEndExcluding": "8.12.0.6",
              "versionStartIncluding": "8.12.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4B066B5-D01B-43AE-B4DC-AF560D6B953C",
              "versionEndExcluding": "8.13.1.0",
              "versionStartIncluding": "8.13.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04F61E46-8412-4B8D-BE7B-EBF61BE52C54",
              "versionEndExcluding": "10.4.1.9",
              "versionStartIncluding": "10.4.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEF8618F-C126-4F8F-951F-6D62FE8FAB22",
              "versionEndExcluding": "10.7.2.1",
              "versionStartIncluding": "10.7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}