CVE-2025-37138: arubanetworks arubaos Command Injection

Vulnerability summary

CVE-2025-37138 is a medium (CVSS 6.2) Command Injection vulnerability in arubanetworks arubaos. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.6% of scored vulnerabilities.

Timeline

1. 14-10-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.