Hewlett Packard Enterprise (Hpe) vulnerabilities, page 3
594 vulnerabilities
Known vulnerabilities in Hewlett Packard Enterprise (Hpe) products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 86 products.
HighCVE-2025-37171arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceSuccessful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.EPSS1.38%MediumCVE-2025-37136arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.EPSS0.36%CriticalCVE-2025-37168arubanetworks · arubaos +1 moreUnauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating SystemArbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices.EPSS0.45%HighCVE-2025-37181arubanetworks · edgeconnect_sd-wan_orchestrator +1 moreAuthenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceVulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.EPSS0.48%MediumCVE-2025-37148hewlett packard enterprise (hpe) · arubaos (aos)Kernel Panic triggered by Modified Ethernet Frames leads to Denial of Service VulnerabilityA vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to potentially disrupt network services and require manual intervention to restore functionality.EPSS0.26%HighCVE-2025-37163arubanetworks · airwave +1 moreAuthenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLIA command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.EPSS0.96%HighCVE-2025-37182arubanetworks · edgeconnect_sd-wan_orchestrator +1 moreAuthenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceVulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.EPSS0.48%HighCVE-2025-37183arubanetworks · edgeconnect_sd-wan_orchestrator +1 moreAuthenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceVulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.EPSS0.48%HighCVE-2025-37176arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflowA command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.EPSS1.43%HighCVE-2025-37133arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.EPSS1.23%HighCVE-2025-37146hewlett packard enterprise (hpe) · arubaos (aos)Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code ExecutionA vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.EPSS0.89%HighCVE-2025-37159hewlett packard enterprise (hpe) · hpe aruba networking aos-cx +1 moreAuthenticated Session Hijacking Allows Unauthorized Access in Network Switching SoftwareA vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.EPSS0.27%MediumCVE-2025-37139hewlett packard enterprise (hpe) · arubaos (aos)Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable BootA vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.EPSS0.14%MediumCVE-2025-37185arubanetworks · edgeconnect_sd-wan_orchestrator +1 moreAuthenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration InterfaceVulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface and thereby make unauthorized arbitrary configuration changes to the host.EPSS0.27%HighCVE-2025-37172arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceSuccessful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.EPSS1.26%MediumCVE-2025-37141arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceArbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.EPSS0.35%HighCVE-2025-37127hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Replay Attack contains Cryptographic VulnerabilityA vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems.EPSS0.14%CriticalCVE-2025-37096hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS1.25%HighCVE-2025-37155hewlett packard enterprise (hpe) · hpe aruba networking aos-cx +1 moreAuthenticated Privilege Escalation Allows Unauthorized Access in Network Management InterfaceA vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.EPSS0.13%CriticalCVE-2025-37094hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.EPSS0.86%