Cyber Posture

CVE-2025-25039

Medium

Published: 04 February 2025

Published
04 February 2025
Modified
28 March 2025
KEV Added
—
Patch
—
CVSS Score 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0021 42.4th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2025-25039 is a vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM). It allows remote authenticated users to run arbitrary commands on the underlying host, stemming from an OS command injection issue classified as CWE-78. The vulnerability has a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

Remote authenticated users with high privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables the attacker to execute arbitrary commands as a lower-privileged user on the underlying operating system, resulting in limited impacts to confidentiality, integrity, and availability.

The HPE security advisory provides details on mitigation and patches at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US.

Details

CWE(s)
CWE-78

Affected Products

arubanetworks
clearpass policy manager
6.11.0 — 6.11.10 · 6.12.0 — 6.12.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in web management interface enables exploitation of public-facing app (T1190) and arbitrary command execution via Unix shell (T1059.004) on the host.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References