This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] HPE fixes 24 vulnerabilities in various products
HPE is fixing 24 vulnerabilities in various products. The most serious of them are listed below, the remaining ones are listed at [1][2][3][5]. Products and their fixed versions: HPE Aruba Networking AOS-CX - 10.16.1001, 10.15.1030, 10.14.1060, 10.13.1101, 10.10.1170 [1], HPE Aruba Networking Management Software (AirWave) - 8.3.0.5 [2], HPE Compute Scale-up Server 3200 - v1.55.98 [3], HPE Telco Service Activator - v10.4.0 [5].
Due to insufficient access control in the SSH restricted interface of the network management services in HPE Aruba Networking AOS-CX, an authenticated remote attacker with read-only privileges can obtain administrator privileges on the compromised system [1].
The vulnerability is present in product:
- HPE Aruba Networking AOS-CX; <10.16.1001; <10.15.1030, <10.14.1060; <10.13.1101; <10.10.1170
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37155 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 18. 11. 2025.
Due to insufficient input validation in the CLI interface of HPE Aruba Networking Management Software (AirWave), an authenticated remote attacker can carry out a command injection attack, as a result of which they gain the ability to execute commands in the operating system with elevated privileges [2].
The vulnerability is present in product:
- HPE Aruba Networking Management Software (AirWave);<8.3.0.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37163 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 18. 11. 2025.
Due to insufficient isolation in the stream cache mechanism in certain Intel processors used in HPE Compute Scale-up Server 3200, an authenticated local attacker can gain elevated privileges [3]. The list of affected processors can be found at [4]
The vulnerability is present in product:
- HPE Compute Scale-up Server 3200; <v1.55.98
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-20109 at cve.org, NVD
- CWE-653: Improper Isolation or Compartmentalization at cwe.mitre.org
The vulnerability was publicly disclosed 18. 11. 2025.
Due to an implementation flaw in the processing of client requests in HPE Telco Service Activator (Undertow), an unauthenticated remote attacker can repeatedly trigger server-side resets of HTTP/2 streams, which may result in a DoS attack [5][6].
The vulnerability is present in product:
- HPE Telco Service Activator; <v10.4.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-9784 at cve.org, NVD
- CWE-404: Improper Resource Shutdown or Release at cwe.mitre.org
The vulnerability was publicly disclosed 21. 11. 2025.
Links
- [1] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
- [2] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04971en_us&docLocale=en_US
- [3] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04969en_us&docLocale=en_US
- [4] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04973en_us&docLocale=en_US
- [5] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01249.html
- [6] https://nvd.nist.gov/vuln/detail/CVE-2025-9784
By CESNET, z.s.p.o. Henrieta Paločková on 24. 11. 2025.