Skip to content
OpenAdvisories
Medium · 6.2 CVE-2025-37138 EUVD-2025-34437GHSA-jr3w-w834-fj2p

Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)

Published Oct 14, 2025 · Updated Oct 14, 2025 · Assigned by hpe

Description

An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.

Affected products

VendorProductAffectedFixed
Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 10.7.0.0 – ≤ 10.7.1.1, 10.4.0.0 – ≤ 10.4.1.8, 8.13.0.0 – ≤ 8.13.0.1, 8.12.0.0 – ≤ 8.12.0.5, 8.10.0.0 – ≤ 8.10.0.18 —

Advisories 1

References