CVE-2025-37176: fallo de gravedad media en Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 1.4%
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)CVEs relacionadas — Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-79861CRITICALUnauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10EPSS 1.7%CVE-2026-79846CRITICALUnauthenticated Command Injection Vulnerabilities in AOS-8EPSS 1.6%CVE-2026-95715MEDIUMUnauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceEPSS 1.6%CVE-2026-79864CRITICALUnauthenticated Adjacent Command Injection Vulnerability in AOS-10EPSS 1.5%CVE-2026-79857CRITICALUnauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolEPSS 1.4%CVE-2025-37171HIGHAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceEPSS 1.4%