Arubanetworks Arubaos vulnerabilities

CVE-2025-37171 [HIGH] CWE-78 CVE-2025-37171: Authenticated command injection vulnerabilities exist in the web-based management interface of mobil Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2026-44854 [HIGH] CWE-77 CVE-2026-44854: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

CVE-2026-44853 [HIGH] CWE-77 CVE-2026-44853: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

CVE-2026-44865 [HIGH] CWE-77 CVE-2026-44865: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Op Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-44872 [HIGH] CWE-77 CVE-2026-44872: A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 O A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.

CVE-2025-37175 [HIGH] CWE-434 CVE-2025-37175: Arbitrary file upload vulnerability exists in the web-based management interface of mobility conduct Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system.

CVE-2008-7023 [CRITICAL] CWE-310 CVE-2008-7023: Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same d Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

CVE-2025-37170 [HIGH] CWE-78 CVE-2025-37170: Authenticated command injection vulnerabilities exist in the web-based management interface of mobil Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2025-37172 [HIGH] CWE-78 CVE-2025-37172: Authenticated command injection vulnerabilities exist in the web-based management interface of mobil Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2025-37132 [HIGH] CWE-434 CVE-2025-37132: An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-1 An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.

CVE-2025-37174 [HIGH] CWE-277 CVE-2025-37174: Authenticated arbitrary file write vulnerability exists in the web-based management interface of mob Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating s

CVE-2026-44852 [HIGH] CWE-296 CVE-2026-44852: An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based manage An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Su

CVE-2026-44859 [HIGH] CWE-121 CVE-2026-44859: Stack-based buffer overflow vulnerabilities exist in several underlying management service component Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Success

CVE-2026-44856 [HIGH] CWE-121 CVE-2026-44856: Stack-based buffer overflow vulnerabilities exist in several underlying management service component Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Success

CVE-2026-44857 [HIGH] CWE-121 CVE-2026-44857: Stack-based buffer overflow vulnerabilities exist in several underlying management service component Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Success

CVE-2026-44855 [HIGH] CWE-121 CVE-2026-44855: Stack-based buffer overflow vulnerabilities exist in several underlying management service component Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Success

CVE-2026-44858 [HIGH] CWE-121 CVE-2026-44858: Stack-based buffer overflow vulnerabilities exist in several underlying management service component Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Success

CVE-2026-44862 [HIGH] CWE-89 CVE-2026-44862: SQL injection vulnerabilities exist in several underlying service components accessible through the SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database querie

CVE-2026-44863 [HIGH] CWE-89 CVE-2026-44863: SQL injection vulnerabilities exist in several underlying service components accessible through the SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database querie

CVE-2026-44864 [HIGH] CWE-89 CVE-2026-44864: SQL injection vulnerabilities exist in several underlying service components accessible through the SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database querie