Hewlett Packard Enterprise (Hpe) vulnerabilities, page 4

594 vulnerabilities

Known vulnerabilities in Hewlett Packard Enterprise (Hpe) products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 86 products.

8.8HighCVE-2025-37162arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerability Leading to Arbitrary Remote Command ExecutionA vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.EPSS0.87%8.8HighCVE-2025-37123hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Command Injection leads to Unauthorized Actions in CLI InterfaceA vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.EPSS0.47%7.2HighCVE-2025-37134arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceAn authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.EPSS1.23%7.2HighCVE-2025-37102hewlett packard enterprise (hpe) · hpe networking instant onAuthenticated Command Injection Vulnerability In Instant On Command Line InterfaceAn authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.EPSS1.50%3.5LowCVE-2025-37108hewlett packard enterprise (hpe) · hpe telco service activatorHPE Telco Service Activator, Protection Mechanism FailureCross-site scripting vulnerability has been identified in HPE Telco Service Activator productEPSS0.21%7.7HighCVE-2025-37100hewlett packard enterprise (hpe) · hpe aruba networking private 5g coreExposure of Sensitive Information to an Unauthorized User in HPE Aruba Networking Private 5G CoreA vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.EPSS0.49%6.2MediumCVE-2025-37138arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.EPSS0.66%7.2HighCVE-2025-37173arubanetworks · arubaos +1 moreImproper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.EPSS0.44%4.9MediumCVE-2025-37143arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required)An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits.EPSS0.38%9.8CriticalCVE-2025-37087hewlett packard enterprise (hpe) · hpe performance cluster manager (hpcm)hewlett packard enterprise (hpe) hpe performance cluster manager (hpcm)A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server host.EPSS0.42%6.5MediumCVE-2025-37160hewlett packard enterprise (hpe) · hpe aruba networking aos-cx +1 moreAuthenticated Broken Access Control (BAC) in REST API Configuration ServiceA broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.EPSS0.30%7.8HighCVE-2025-37186hewlett packard enterprise (hpe) · virtual intranet access (via)Local Privilege Escalation Vulnerability in HPE Aruba Networking Virtual Intranet Access (VIA) Client for LinuxA local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.EPSS0.17%6.8MediumCVE-2025-37088hewlett packard enterprise (hpe) · hpe cray data virtualization service (dvs)hewlett packard enterprise (hpe) hpe cray data virtualization service (dvs)A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability may lead to local/cluster unauthorized access.EPSS0.16%7.5HighCVE-2025-37161arubanetworks · arubaos +1 moreUnauthenticated Remote Denial-of-Service (DoS) Vulnerability in Web Management InterfaceA vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.EPSS0.42%7.2HighCVE-2025-37170arubanetworks · arubaos +1 moreAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceSuccessful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.EPSS1.29%3.5LowCVE-2025-37109hewlett packard enterprise (hpe) · hpe telco service activatorHPE Telco Service Activator, Protection Mechanism FailureCross-site scripting vulnerability has been identified in HPE Telco Service Activator productEPSS0.21%7.5HighCVE-2025-37125hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayBroken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network ResourcesA broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperlyEPSS0.36%7.2HighCVE-2025-37174arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management InterfaceSuccessful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.EPSS0.56%5.3MediumCVE-2025-37179arubanetworks · arubaos +1 moreOut-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating SystemMultiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.EPSS0.36%5.5MediumCVE-2025-27087hewlett packard enterprise (hpe) · hpe cray operating system (cos)hewlett packard enterprise (hpe) hpe cray operating system (cos)A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack.EPSS0.19%