CVE-2025-37159: medium-severity vulnerability in Hewlett Packard Enterprise (HPE) HPE Aruba…
Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.8epss 0.3%
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected products
Hewlett Packard Enterprise (HPE) · HPE Aruba Networking AOS-CXRelated CVEs — Hewlett Packard Enterprise (HPE) HPE Aruba…
In the same product, most dangerous first.
CVE-2025-37158MEDIUMAuthenticated Command Injection allows Unauthorized Command Execution in AOS-CXEPSS 0.6%CVE-2025-37156MEDIUMArubaOS-CX Platform-Level Denial-of-Service VulnerabilityEPSS 0.3%CVE-2025-37160MEDIUMAuthenticated Broken Access Control (BAC) in REST API Configuration ServiceEPSS 0.3%CVE-2025-37155HIGHAuthenticated Privilege Escalation Allows Unauthorized Access in Network Management InterfaceEPSS 0.1%