CVE-2025-37173

Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)

High · published January 13, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

⚡ An improper input handling flaw could let an authenticated user wreak havoc in your mobility conductor's management interface! Think of this like a restaurant where a staff member can modify the orders as they please — if they slip in a wrong ingredient, the whole dish could end up a disaster! An attacker with valid credentials could trigger all sorts of unintended behaviors, possibly leading to data loss or system instability. Imagine your carefully orchestrated network management suddenly turning chaotic and throwing everything into disarray! 🚨

Put simply

Think of this like a restaurant where a staff member can modify the orders as they please — if they slip in a wrong ingredient, the whole dish could end up a disaster! This vulnerability arises from insufficient validation of user inputs in the web-based management interface of mobility conductors operating on AOS-10 or AOS-8, allowing malicious actors to manipulate the system's behavior after logging in.

What to do

An attacker with valid credentials could trigger all sorts of unintended behaviors, possibly leading to data loss or system instability. Imagine your carefully orchestrated network management suddenly turning chaotic and throwing everything into disarray! 🚨 Ensure you patch your systems to the latest firmware version that addresses CVE-2025-37173. It's crucial to review and strengthen input validation mechanisms in your configuration to safeguard against potential misuse. 🛡️ You've got this! By taking these steps, you're one step closer to becoming a security hero! 💪✨

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Published
2026-01-13T20:04Z
EPSS history
Timeline
  • 13 JAN 20:04Z
    Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)
    cvelistv5