This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HPE fixes 13 vulnerabilities in various products
HPE Aruba fixes 12 vulnerabilities in Mobility Conductors, Mobility Controllers, WLAN and SD-WAN Gateways (AOS-10 and AOS-8) with versions 10.7.2.2, 10.4.1.10, 8.13.1.1 and 8.10.0.21 [1]. In addition, version 4.7.6 (released on 15 February 2026) will fix 1 vulnerability in HPE Aruba Networking VIA client for Linux [2]. The most severe vulnerabilities are listed below; the rest are listed at [1][2].
An unauthenticated remote attacker can delete arbitrary files on the affected system and potentially cause a denial-of-service condition on the affected devices [1].
The vulnerability is present in product:
- Aruba AOS; >=10.7, <10.7.2.2; >=10.4, <10.4.1.10; >=8.13, <8.13.1.1; ,>=8.10, <8.10.0.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
More information:
- CVE-2025-37168 at cve.org, NVD
- CWE-73: External Control of File Name or Path at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
An authenticated remote attacker can execute arbitrary code as a privileged user on the operating system of the affected device via the web interface [1].
The vulnerability is present in product:
- Aruba AOS; >=10.7, <10.7.2.2; >=10.4, <10.4.1.10; >=8.13, <8.13.1.1; ,>=8.10, <8.10.0.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37169 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
An authenticated remote attacker can execute arbitrary commands as a privileged user on the operating system of the affected device via the web interface [1].
The vulnerability is present in product:
- Aruba AOS; >=10.7, <10.7.2.2; >=10.4, <10.4.1.10; >=8.13, <8.13.1.1; ,>=8.10, <8.10.0.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37170 at cve.org, NVD
- CVE-2025-37171 at cve.org, NVD
- CVE-2025-37172 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
An authenticated remote attacker can upload arbitrary files as a privileged user via the web interface and execute arbitrary commands on the operating system of the affected device [1].
The vulnerability is present in product:
- Aruba AOS; >=10.7, <10.7.2.2; >=10.4, <10.4.1.10; >=8.13, <8.13.1.1; ,>=8.10, <8.10.0.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37175 at cve.org, NVD
- CWE-434: Unrestricted Upload of File with Dangerous Type at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
An authenticated local attacker can escalate their privileges and execute arbitrary code with root privileges [2].
The vulnerability is present in product:
- HPE Aruba Networking VIA client (linux); <4.7.6
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37186 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 14. 1. 2026.