CVE-2025-37173 — Improper Input Validation in Arubaos

CWE-20 — Improper Input Validation3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 73.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks ArubaosHewlett Packard Enterprise Arubaos
Timeline
PublishedJan 13

Description

An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDarubanetworks/arubaos6.5.4.0 — 8.10.0.21+3
▶CVEListV5hewlett_packard_enterprise/arubaos10.6.0.0 — 10.7.2.1+3

🔴Vulnerability Details

2
GHSA
GHSA-rwcr-87vw-4v3g: An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating↗2026-01-13
▶
CVEList
Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)↗2026-01-13
▶
CVE-2025-37173 — Improper Input Validation in Arubaos | cvebase