CVE-2025-37157CWE-78CWE-94command-injectioncode-injection

CVE-2025-37157

Medium · published November 19, 2025

CVSS v3.1
6.7
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00641 · 50.1th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-11-19T00:15Z
Affected products (5)
ProductVersionsFixed in
hpe/arubaos-cx≥ 10.10.0000, < 10.10.117010.10.1170
hpe/arubaos-cx≥ 10.13.0000, < 10.13.110110.13.1101
hpe/arubaos-cx≥ 10.14.0000, < 10.14.106010.14.1060
hpe/arubaos-cx≥ 10.15.0000, < 10.15.103010.15.1030
hpe/arubaos-cx≥ 10.16.0000, < 10.16.100110.16.1001
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 18 NOV 18:48Z
    Authenticated Command Injection allows Unauthorized Command Execution in AOS-CX
    cvelistv5