← Vulnerability feed

Vulnerability record · CVE-2025-37158 · published 18 November 2025

CVE-2025-37158: Hpe arubaos-cx os command injection vulnerability

Hpe · Arubaos Cx

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

8.8 CVSS 3.1 High EPSS 0.66% · top 50.5% CWE-78 · OS command injection
8.8CVSS 3.1 base score
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US Vendor Advisory

Track CVE-2025-37158 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-73778Hpe arubaos-cx weak password requirements vulnerabilityA vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker …EPSS 0.51%9.8CVE-2026-73749Hpe arubaos-cx improper access control vulnerabilityMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker co…EPSS 0.82%9.8CVE-2026-23813Hpe arubaos-cx improper authentication vulnerabilityA vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote a…EPSS 0.74%8.8CVE-2026-73782Hpe arubaos-cx vulnerabilityA format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exp…EPSS 0.42%8.8CVE-2026-73763Hpe arubaos-cx command injection vulnerabilityA vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful expl…EPSS 0.48%8.8CVE-2026-73750Hpe arubaos-cx improper access control vulnerabilityVulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could e…EPSS 0.80%8.8CVE-2026-73751Hpe arubaos-cx command injection vulnerabilityAn authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands …EPSS 0.66%8.8CVE-2026-73752Hpe arubaos-cx path traversal vulnerabilityAn unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an at…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2025-37158), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.