Hewlett Packard Enterprise (Hpe) vulnerabilities, page 5

594 vulnerabilities

Known vulnerabilities in Hewlett Packard Enterprise (Hpe) products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 87 products.

4.9MediumCVE-2025-37142arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceArbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.EPSS0.35%7.2HighCVE-2025-37175arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management InterfaceArbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system.EPSS0.51%9.8CriticalCVE-2025-37095hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.EPSS1.18%6.7MediumCVE-2025-37129hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Remote Code Execution allows Exploit in Scripts FeatureA vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.EPSS0.22%8.6HighCVE-2025-37124hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayUnauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge InterfaceA vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.EPSS0.40%7.5HighCVE-2025-37166hewlett packard enterprise (hpe) · instant onUnexpected shutdown in HPE Instant On Access Points after processing specific packetsA vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor could leverage this vulnerability to conduct a Denial-of-Service attack on a target network.EPSS0.47%7.5HighCVE-2025-37165hewlett packard enterprise (hpe) · instant onExposure of VLAN information in unintended network interfacesA vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gain knowledge of internal network configuration details through inspecting impacted packets.EPSS0.41%7.2HighCVE-2025-37126hewlett packard enterprise (hpe) · hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line InterfaceA vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system.EPSS0.64%9.8CriticalCVE-2025-37090hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA server-side request forgery vulnerability exists in HPE StoreOnce Software.EPSS0.62%9.8CriticalCVE-2025-37091hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS1.19%6.5MediumCVE-2025-37177arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.EPSS0.37%6.1MediumCVE-2025-37122hewlett packard enterprise (hpe) · hpe aruba networking clearpass policy managerUnauthenticated Reflected Cross-Site ScriptingA vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.EPSS0.25%4.9MediumCVE-2025-37144arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceArbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.EPSS0.45%6.5MediumCVE-2025-37135arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.EPSS0.36%6.8MediumCVE-2025-37156hewlett packard enterprise (hpe) · hpe aruba networking aos-cx +1 moreArubaOS-CX Platform-Level Denial-of-Service VulnerabilityA platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional.EPSS0.32%7.1HighCVE-2025-37147hewlett packard enterprise (hpe) · arubaos (aos)Secure Boot Bypass allows for Compromise of Hardware Root of TrustA Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability to run modified or custom firmware on affected Access Points.EPSS0.15%7.1HighCVE-2025-37104hewlett packard enterprise (hpe) · hpe telco service orchestratorHPE Telco Service Orchestrator Software, Authenticated SQL InjectionA security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated clients.EPSS0.25%9.8CriticalCVE-2025-37103hewlett packard enterprise (hpe) · hpe networking instant onHardcoded Credential Exposure Allows Unauthorized Access in Web InterfaceHard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system.EPSS1.09%4.9MediumCVE-2025-37145arubanetworks · arubaos +1 moreAuthenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management InterfaceArbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.EPSS0.45%9.8CriticalCVE-2025-37089hewlett packard enterprise (hpe) · hpe storeonce software +1 morehewlett packard enterprise (hpe) hpe storeonce softwareA command injection remote code execution vulnerability exists in HPE StoreOnce Software.EPSS1.25%