Cyber Posture

CVE-2025-37157

Medium

Published: 18 November 2025

Published
18 November 2025
Modified
04 December 2025
KEV Added
Patch
CVSS Score 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0005 16.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-37157 is a command injection vulnerability in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct remote code execution (RCE) on the affected system. The vulnerability is linked to CWE-94 (Improper Control of Generation of Code) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command), with a CVSS v3.1 base score of 6.7 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). It was published on 2025-11-18.

An authenticated remote attacker can exploit this vulnerability to achieve RCE. The CVSS vector indicates local attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, high impact to confidentiality and integrity, and no impact to availability.

Mitigation details are available in the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US.

Details

CWE(s)
CWE-94CWE-78

Affected Products

hpe
arubaos-cx
10.10.0000 — 10.10.1170 · 10.13.0000 — 10.13.1101 · 10.14.0000 — 10.14.1060

MITRE ATT&CK Enterprise Techniques

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Command injection vulnerability in AOS-CX (network device OS) enables remote code execution via Network Device CLI (T1059.008) and constitutes exploitation of a remote service (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References