CVE-2025-37176

Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow

Medium · published January 13, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01426 · 72.7th percentile
Published
2026-01-13T20:07Z
EPSS history
Timeline
  • 13 JAN 20:07Z
    Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow
    cvelistv5