CVE-2025-37176: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · Command Injection
Affects Hewlett Packard Enterprise (HPE) ArubaOS (AOS)Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 1.4% chance of exploitation in 30 days – higher than 72% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 13 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hewlett Packard Enterprise (HPE)ArubaOS (AOS) | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-37176, organizations should implement the following specific measures: 1) Restrict privileged user access strictly to trusted personnel and enforce the principle of least privilege to minimize the number of users who can exploit this vulnerability. 2) Monitor and audit privileged user activities on ArubaOS devices to detect any anomalous or unauthorized command executions. 3) Apply ArubaOS patches or updates as soon as Hewlett Packard Enterprise releases them to address this vulnerability. 4) Employ network segmentation to isolate ArubaOS management interfaces from general user networks, reducing exposure to potential attackers. 5) Use multi-factor authentication (MFA) for all privileged accounts to reduce the risk of credential compromise. 6) Regularly review and harden device configurations to limit the attack surface, including disabling unnecessary services and interfaces. 7) Consider deploying intrusion detection or prevention systems capable of identifying suspicious command injection attempts targeting ArubaOS devices. These targeted actions go beyond generic advice by focusing on controlling privileged access, monitoring, and network architecture adjustments specific to ArubaOS environments.
Description
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.