CVE-2025-27078: Hewlett Packard Enterprise (HPE) AOS-10 AP · OS Command Injection
Affects Hewlett Packard Enterprise (HPE) AOS-10 APSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 8 Apr 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hewlett Packard Enterprise (HPE) AOS-10 AP | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-27078, organizations should implement the following specific measures: 1) Immediately restrict CLI access to trusted administrators by enforcing strong authentication mechanisms such as multi-factor authentication and limiting access via network segmentation or VPNs. 2) Monitor and audit CLI access logs for unusual or unauthorized activity to detect potential exploitation attempts early. 3) Apply principle of least privilege by ensuring that only necessary personnel have high-level CLI access and consider using role-based access controls to limit command execution capabilities. 4) Harden device configurations by disabling unused services and interfaces that could provide alternative access paths. 5) Regularly update and patch affected HPE AOS-8 and AOS-10 AP devices as soon as vendor patches become available, even if no public exploits are known. 6) Employ network-level protections such as intrusion detection/prevention systems (IDS/IPS) to detect anomalous command injection patterns or suspicious traffic to management interfaces. 7) Consider isolating management interfaces from general network access to reduce exposure. 8) Conduct internal penetration testing and vulnerability assessments focusing on administrative access controls and command injection vectors. These targeted actions go beyond generic advice by focusing on access control hardening, monitoring, and proactive patch management specific to this vulnerability's exploitation vector.
Description
A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise.