CVE-2025-37176
HIGH WAF: High
CVSS 7.2
Published: 2026-01-13
CWE-77
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.
WAF Coverage Analysis
Command Injection
High WAF Coverage
OWASP: A03:2021 Injection
932xxx - Remote Code Execution
Affected Software
| Vendor | Product | Version |
|---|---|---|
| arubanetworks | arubaos | 8.6.0.0 - 8.10.0.21 |
| arubanetworks | arubaos | 8.11.0.0 - 8.13.1.1 |
References
- support.hpe.com (Vendor Advisory)