Skip to content
OpenAdvisories
High · 7.2 CVE-2025-37133 EUVD-2025-34443GHSA-92j2-m5rq-6p7m

Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.

Published Oct 14, 2025 · Updated Feb 26, 2026 · Assigned by hpe

Vendor: Hewlett Packard Enterprise (HPE) Product: ArubaOS (AOS)

Description

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

Affected products

VendorProductAffectedFixed
Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 10.7.0.0 – ≤ 10.7.1.1, 10.4.0.0 – ≤ 10.4.1.8, 8.13.0.0 – ≤ 8.13.0.1, 8.12.0.0 – ≤ 8.12.0.5, 8.10.0.0 – ≤ 8.10.0.18 —

Advisories 1

References