HPE Aruba AOS-8/10 Multiple Vulnerabilities Advisory (CVE-2025-37168/169/170-172)

Vulnerability Key Information Vulnerability Overview Document ID: HPESBNW04987 rev.1 Title: Multiple Vulnerabilities Affect HPE Aruba Networking AOS-8 and AOS-10 Mobility Controllers, Controllers, and Gateways Potential Security Impact: Remote Arbitrary Command Execution, Arbitrary File Deletion, Execution of Arbitrary Commands, Unauthorized Arbitrary Command Execution, Unauthorized File System Write Access, Buffer Overflow, Arbitrary File Upload, Stack Overflow, Input Validation Vulnerability Details Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System (CVE-2025-37168) Description: An arbitrary file deletion vulnerability exists in the AOS-8 operating system, which could allow an unauthenticated remote attacker to delete any file, potentially leading to a denial-of-service condition on the affected device. Discovery: Discovered and reported by n3k via HPE Aruba Networking’s vulnerability bounty program. CVSS v3.1 Base Score: 8.2 Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface (CVE-2025-37169) Description: A stack overflow vulnerability exists in the AOS-10 web-based management interface, which could allow an authenticated malicious attacker to execute arbitrary code on the underlying operating system with privileged user rights. Discovery: Discovered by zzcentury from Ubisectech Sirius Team and reported via HPE Aruba Networking’s vulnerability bounty program. CVSS v3.1 Base Score: 7.2 Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface (CVE-2025-37170, CVE-2025-37171, CVE-2025-37172) Description: Command injection vulnerabilities exist in the AOS-8 web-based management interface, which could allow an authenticated malicious attacker to execute arbitrary commands on the underlying operating system with privileged user rights. Discovery: Discovered by zzcentury from Ubisectech Sirius Team and reported via HPE Aruba Networking’s vulnerability bounty program. CVSS v3.1 Base Score: 7.2 Remediation Upgrade Versions: - AOS-10.7.x.x: 10.7.2.2 and above - AOS-10.4.x.x: 10.4.1.10 and above - AOS-8.13.x.x: 8.13.1.1 and above - AOS-8.10.x.x: 8.10.0.21 and above Download Link: Available from HPE Networking Support Portal: https://networkingsslippe.com/downloads/fileTypes=SOFTWARE Additional Information Support: For assistance implementing the recommendations in this security bulletin, contact HPE Services support channels. Reporting: To report any potential security vulnerabilities in HPE supported products, use the web form: https://www.hpe.com/info/report-security-vulnerability

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba AOS-8/10 Multiple Vulnerabilities Advisory (CVE-2025-37168/169/170-172)