CVE-2025-37163CWE-77CWE-78command-injection

CVE-2025-37163

High · published November 19, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

⚡ An authenticated attacker can send rogue commands through the HPE Aruba Networking Airwave Platform's command line interface! This flaw opens the door to executing arbitrary commands with elevated privileges on your system. 🔥 Think of this vulnerability like a trusted employee who has access to a secure vault but can also sneak in a fake request for extra keys—suddenly, they can not only access sensitive materials but also manipulate what’s inside! If exploited, this vulnerability could allow attackers to execute any command they want on the operating system, potentially compromising confidential data, altering system configurations, or even taking complete control of the network. The consequences can be absolutely devastating, especially for organizations relying heavily on the Airwave platform!

Put simply

Think of this vulnerability like a trusted employee who has access to a secure vault but can also sneak in a fake request for extra keys—suddenly, they can not only access sensitive materials but also manipulate what’s inside! This command injection vulnerability arises from insufficient input validation in the command line interface of the HPE Aruba Networking Airwave Platform, allowing authenticated users to execute commands at a higher privilege level than intended.

What to do

If exploited, this vulnerability could allow attackers to execute any command they want on the operating system, potentially compromising confidential data, altering system configurations, or even taking complete control of the network. The consequences can be absolutely devastating, especially for organizations relying heavily on the Airwave platform! Immediately update to the latest version of the HPE Aruba Networking Airwave Platform that addresses this vulnerability. Additionally, review access controls to ensure that only trusted users have command line access. Consistent monitoring for unusual activity can also help mitigate risks. You've got this! With these steps, you'll secure your environment and maintain your hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00964 · 61.3th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-11-19T00:15Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/airwave< 8.3.0.58.3.0.5
References (1)
EPSS history
Timeline
  • 18 NOV 19:06Z
    Authenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLI
    cvelistv5