Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

AOS-8 CLI allows malicious users to run system commands

CVE-2025-37133 · published 1 year ago
Summary

An attacker with a user account can run any system command on the AOS-8 Controller/Mobility Conductor, potentially accessing sensitive parts of the system. This is a serious concern for organizations that use this software, as it could allow unauthorized actions. To mitigate this, update the software to the latest version or apply a patch if available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
arubanetworks arubaos >= 8.10.0.0, < 8.10.0.19
>= 8.12.0.0, < 8.12.0.6
>= 8.13.0.0, < 8.13.1.0
>= 10.4.0.0, < 10.4.1.9
>= 10.7.0.0, < 10.7.2.1
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Original advisory text
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious ...
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published14 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-37133 · NVD
Track software like this
Free during beta