CVE-2025-37156

published 2025-11-18

CVE-2025-37156: A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker…

Priority P4 32 medium 6.8 CVSS 3.1

AV N AC L PR H UI N S C C N I N A H

A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	hpe_aruba_networking_aos-cx	10.10.0000 – 10.10.1160	—
hewlett_packard_enterprise	hpe_aruba_networking_aos-cx	10.13.0000 – 10.13.1090	—
hewlett_packard_enterprise	hpe_aruba_networking_aos-cx	10.14.0000 – 10.14.1050	—
hewlett_packard_enterprise	hpe_aruba_networking_aos-cx	10.15.0000 – 10.15.1020	—
hewlett_packard_enterprise	hpe_aruba_networking_aos-cx	10.16.0000 – 10.16.1000	—
hpe	arubaos-cx	>= 10.10.0000 < 10.10.1170	10.10.1170
hpe	arubaos-cx	>= 10.13.0000 < 10.13.1101	10.13.1101
hpe	arubaos-cx	>= 10.14.0000 < 10.14.1060	10.14.1060
hpe	arubaos-cx	>= 10.15.0000 < 10.15.1030	10.15.1030
hpe	arubaos-cx	>= 10.16.0000 < 10.16.1001	10.16.1001

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.