CVE-2025-37136 - Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)

Back Back to CVE browser

MEDIUM

Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)

Published Oct 14, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

Affected products

Vendor Hewlett Packard Enterprise (HPE) Product ArubaOS (AOS) Default
affected
- Version
  10.4.0.0
  Status
  affected
  Constraints
  <=10.4.1.8
- Version
  10.7.0.0
  Status
  affected
  Constraints
  <=10.7.1.1
- Version
  8.10.0.0
  Status
  affected
  Constraints
  <=8.10.0.18
- Version
  8.12.0.0
  Status
  affected
  Constraints
  <=8.12.0.5
- Version
  8.13.0.0
  Status
  affected
  Constraints
  <=8.13.0.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hewlett Packard Enterprise (HPE)

ArubaOS (AOS)

affected

Version	Status	Constraints
10.4.0.0	affected	<=10.4.1.8
10.7.0.0	affected	<=10.7.1.1
8.10.0.0	affected	<=8.10.0.18
8.12.0.0	affected	<=8.12.0.5
8.13.0.0	affected	<=8.13.0.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34439
Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34439		Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US		Vendor Advisory