CVE-2025-37171

Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface

High · published January 13, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

⚡ An authenticated command injection vulnerability lurks in the management interface of mobility conductors running AOS-8! This means a malicious actor could exploit it to run arbitrary commands as a privileged user. 😱 Think of it like a hotel with a staff member who can access any room just by showing a fake ID at the front desk — they could rearrange furniture, snoop through bags, or even change the locks! If someone successfully exploits this vulnerability, they could take over the operating system entirely, potentially causing chaos by running any command they wish. This could lead to data breaches, service disruptions, or unauthorized access to sensitive information, making it crucial to act swiftly!

Put simply

Think of it like a hotel with a staff member who can access any room just by showing a fake ID at the front desk — they could rearrange furniture, snoop through bags, or even change the locks! This vulnerability allows authenticated users to inject malicious commands into the web-based management interface, which the system executes with elevated privileges, compromising the integrity and security of the underlying OS.

What to do

If someone successfully exploits this vulnerability, they could take over the operating system entirely, potentially causing chaos by running any command they wish. This could lead to data breaches, service disruptions, or unauthorized access to sensitive information, making it crucial to act swiftly! To secure your system, ensure you apply the latest patches from the vendor for AOS-8, review user permissions to limit who can access the management interface, and monitor for any unusual activity. Regularly audit your access controls to keep malicious actors at bay. You've got this! With these steps, you'll bolster your security and keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01378 · 71.9th percentile
Published
2026-01-13T20:04Z
EPSS history
Timeline
  • 13 JAN 20:04Z
    Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
    cvelistv5