CVE-2025-37100: hewlett packard enterprise (hpe) hpe aruba networking private 5g core Path Traversal
Vulnerability summary
CVE-2025-37100 is a high (CVSS 7.7) Path Traversal vulnerability in hewlett packard enterprise (hpe) hpe aruba networking private 5g core. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41% of scored vulnerabilities.
Timeline
- 10-06-2025PublishedVulnerability first disclosed.
- 10-06-2025Last modifiedVulnerability information updated.
Description
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.01 pp
From 0.48% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-922Insecure Storage of Sensitive InformationThe product stores sensitive information without properly limiting read or write access by unauthorized actors.
Affected systems
Hewlett packard enterprise (hpe)1 product
- hpe aruba networking private 5g core≥ 1.24.1.0, ≤ 1.25.1.0
1 vendor · 1 product