This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Aruba AOS fixes 17 vulnerabilities

With versions 10.7.2.1,10.4.1.9, 8.13.1.0, 8.12.0.6 and 8.10.0.19, HPE Aruba fixes 17 vulnerabilities in Access Points, Mobility Conductors, Mobility Controllers and WLAN and SD-WAN Gateways (AOS-10 and AOS-8) [1][2]. The most serious vulnerabilities are listed below. As a temporary fix for some of the vulnerabilities, the web and command-line interfaces can be restricted to trusted users only [1][2].

Aruba AOS - command execution (CVE-2025-37132)
CVSS 7.2 (High)

An authenticated remote attacker can upload arbitrary files and execute arbitrary commands in the operating system of the affected machine through the web interface [1].

The vulnerability is present in product:

  • Aruba AOS; >=10.7, <10.7.2.1; >=10.4, <10.4.1.9; >=8.13, <8.13.0.2; >=8.12, <8.12.0.6; >=8.10, <8.10.0.19;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

Aruba AOS - command injection (CVE-2025-37133)
CVSS 7.2 (High)

An authenticated remote attacker can execute commands in the operating system of the affected device within the AOS command-line environment [1].

The vulnerability is present in product:

  • Aruba AOS; >=10.7, <10.7.2.1; >=10.4, <10.4.1.9; >=8.13, <8.13.0.2; >=8.12, <8.12.0.6; >=8.10, <8.10.0.19;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-37133 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 10. 2025.

Aruba AOS - command injection (CVE-2025-37134)
CVSS 7.2 (High)

Due to a flaw in the web interface library, an authenticated remote attacker can execute commands in the operating system of the affected machine [1].

The vulnerability is present in product:

  • Aruba AOS; >=10.7, <10.7.2.0; >=10.4, <10.4.1.8; >=8.13, <8.13.0.1; >=8.12, <8.12.0.5; >=8.10, <8.10.0.18;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-37134 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 10. 2025.

Aruba AOS - secure boot bypass (CVE-2025-37147)
CVSS 7.1 (High)

An unauthenticated local attacker can bypass secure boot, which allows them to run malicious firmware on the affected machine [2].

The vulnerability is present in product:

  • Aruba AOS; >=10.7, <10.7.2.1; >=10.4, <10.4.1.8; >=8.13, <8.13.0.2; >=8.12, <8.12.0.6; >=8.10, <8.10.0.17;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

By CESNET, z.s.p.o. Martin Krajči on 15. 10. 2025.

CESNET, z.s.p.o. Logo