CVE-2025-37144
published 2025-10-14CVE-2025-37144: Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems…
PriorityP430medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.41%
32.8th percentile
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.9 | 10.4.1.9 |
| arubanetworks | arubaos | >= 10.7.0.0 < 10.7.2.1 | 10.7.2.1 |
| arubanetworks | arubaos | >= 8.10.0.0 < 8.10.0.19 | 8.10.0.19 |
| arubanetworks | arubaos | >= 8.12.0.0 < 8.12.0.6 | 8.12.0.6 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.0 | 8.13.1.0 |
| hewlett_packard_enterprise | arubaos | 10.4.0.0 – 10.4.1.8 | — |
| hewlett_packard_enterprise | arubaos | 10.7.0.0 – 10.7.1.1 | — |
| hewlett_packard_enterprise | arubaos | 8.10.0.0 – 8.10.0.18 | — |
| hewlett_packard_enterprise | arubaos | 8.12.0.0 – 8.12.0.5 | — |
| hewlett_packard_enterprise | arubaos | 8.13.0.0 – 8.13.0.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-14
Published