CVE-2025-37136

published 2025-10-14

CVE-2025-37136: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation…

Priority P3 40 medium 6.5 CVSS 3.1

AV N AC L PR H UI N S U C N I H A H

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	arubaos	>= 10.4.0.0 < 10.4.1.9	10.4.1.9
arubanetworks	arubaos	>= 10.7.0.0 < 10.7.2.1	10.7.2.1
arubanetworks	arubaos	>= 8.10.0.0 < 8.10.0.19	8.10.0.19
arubanetworks	arubaos	>= 8.12.0.0 < 8.12.0.6	8.12.0.6
arubanetworks	arubaos	>= 8.13.0.0 < 8.13.1.0	8.13.1.0
hewlett_packard_enterprise	arubaos	10.4.0.0 – 10.4.1.8	—
hewlett_packard_enterprise	arubaos	10.7.0.0 – 10.7.1.1	—
hewlett_packard_enterprise	arubaos	8.10.0.0 – 8.10.0.18	—
hewlett_packard_enterprise	arubaos	8.12.0.0 – 8.12.0.5	—
hewlett_packard_enterprise	arubaos	8.13.0.0 – 8.13.0.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284