Skip to content
OpenAdvisories
High · 7.2 CVE-2025-37134 EUVD-2025-34441GHSA-cv7c-64xv-4wr3

Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface

Published Oct 14, 2025 · Updated Feb 26, 2026 · Assigned by hpe

Description

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

Affected products

VendorProductAffectedFixed
Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 10.7.0.0 – ≤ 10.7.1.1, 10.4.0.0 – ≤ 10.4.1.8, 8.13.0.0 – ≤ 8.13.0.1, 8.12.0.0 – ≤ 8.12.0.5, 8.10.0.0 – ≤ 8.10.0.18 —

Advisories 1

References