CVE-2025-37157: A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a…

PriorityP262high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.60%

44.0th percentile

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	hpe_aruba_networkign_aos-cx	10.10.0000 – 10.10.1160	—
hewlett_packard_enterprise	hpe_aruba_networkign_aos-cx	10.13.0000 – 10.13.1090	—
hewlett_packard_enterprise	hpe_aruba_networkign_aos-cx	10.14.0000 – 10.14.1050	—
hewlett_packard_enterprise	hpe_aruba_networkign_aos-cx	10.15.0000 – 10.15.1020	—
hewlett_packard_enterprise	hpe_aruba_networkign_aos-cx	10.16.0000 – 10.16.1000	—
hpe	arubaos-cx	>= 10.10.0000 < 10.10.1170	10.10.1170
hpe	arubaos-cx	>= 10.13.0000 < 10.13.1101	10.13.1101
hpe	arubaos-cx	>= 10.14.0000 < 10.14.1060	10.14.1060
hpe	arubaos-cx	>= 10.15.0000 < 10.15.1030	10.15.1030
hpe	arubaos-cx	>= 10.16.0000 < 10.16.1001	10.16.1001

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.