CVE-2025-37176: arubanetworks arubaos Command Injection

Vulnerability summary

CVE-2025-37176 is a high (CVSS 7.2) Command Injection vulnerability in arubanetworks arubaos. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.

Timeline

1. 13-01-2026
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.