← Vulnerability feed

Vulnerability record · CVE-2025-37159 · published 18 November 2025

CVE-2025-37159: Hpe arubaos-cx vulnerability

Hpe · Arubaos Cx

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.

7.3 CVSS 3.1 High EPSS 0.26% · top 84.3% CWE-384 · CWE-384
7.3CVSS 3.1 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US Vendor Advisory

Track CVE-2025-37159 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-73778Hpe arubaos-cx weak password requirements vulnerabilityA vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker …EPSS 0.51%9.8CVE-2026-73749Hpe arubaos-cx improper access control vulnerabilityMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker co…EPSS 0.82%9.8CVE-2026-23813Hpe arubaos-cx improper authentication vulnerabilityA vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote a…EPSS 0.74%8.8CVE-2026-73782Hpe arubaos-cx vulnerabilityA format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exp…EPSS 0.42%8.8CVE-2026-73763Hpe arubaos-cx command injection vulnerabilityA vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful expl…EPSS 0.48%8.8CVE-2026-73750Hpe arubaos-cx improper access control vulnerabilityVulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could e…EPSS 0.80%8.8CVE-2026-73751Hpe arubaos-cx command injection vulnerabilityAn authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands …EPSS 0.66%8.8CVE-2026-73752Hpe arubaos-cx path traversal vulnerabilityAn unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an at…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2025-37159), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.