VDB
CVE-2025-37176
CVE-2025-37176
PUBLISHED
CVSS 6.5 MEDIUM
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.
EPSS 0.07% · 22.6th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.07%
22.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| arubanetworks | arubaos | 8.11.0.0, 8.6.0.0, 8.11.0.0 |
| Hewlett Packard Enterprise (HPE) | ArubaOS (AOS) | 8.12.0.0, 8.10.0.0, 8.12.0.0 |
Exploit Intelligence
Timeline
- Jan 13, 2026 CVE Published
- Jan 14, 2026 EPSS Score
- Jan 17, 2026 EPSS Score
- Jan 20, 2026 EPSS Score
- Jan 23, 2026 EPSS Score
- Jan 26, 2026 EPSS Score
- Jan 29, 2026 EPSS Score
- Feb 1, 2026 EPSS Score
- Feb 4, 2026 EPSS Score
- Feb 7, 2026 EPSS Score
- Feb 10, 2026 EPSS Score
- Feb 13, 2026 EPSS Score
References
- https://csaf.arubanetworks.com/2026/hpe_aruba_networking_-_hpesbnw04987.txt advisory
- https://csaf.arubanetworks.com/2026/hpe_aruba_networking_-_hpesbnw04994.txt advisory
- https://csaf.arubanetworks.com/2026/hpe_aruba_networking_-_hpesbnw04988.txt advisory
- https://csaf.arubanetworks.com/2026/hpe_aruba_networking_-_hpesbnw04992.txt advisory
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04987en_us&docLocale=en_US url
- https://nvd.nist.gov/vuln/detail/CVE-2025-37176 advisory