Multiple vulnerabilities in ArubaOS



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2025-37146
CVE-2025-37147
CVE-2025-37148
CWE-ID CWE-78
CWE-693
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 ArubaOS
Operating systems & Components / Operating system

Vendor Aruba Networks

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) OS Command Injection

EUVDB-ID: #VU117360

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37146

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote privileged user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

ArubaOS: before 8.10.0.19

CPE2.3 External links

https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04958.txt


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Protection Mechanism Failure

EUVDB-ID: #VU117361

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37147

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows an attacker to bypass Secure Boot protection.

The vulnerability exists due to insufficient verification of vendor-signed firmware. An attacker with physical access to the system can bypass implemented Secure Boot protection feature and compromise the affected device. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ArubaOS: before 8.10.0.19

CPE2.3 External links

https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04958.txt


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU117362

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-37148

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling Ethernet frames. A remote attacker on the local network can send specially crafted packets to the device and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ArubaOS: before 8.10.0.19

CPE2.3 External links

https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04958.txt


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###