HPE Aruba AOS-8/10 AP CLI Authenticated RCE Vulnerabilities (CVE-2025-27078/27079)

Key Information Vulnerability Title HPE Aruba Networking AOS-8 Instant AP and AOS-10 AP Multiple Vulnerabilities Vulnerability ID HPERMSRM48444 CVE Numbers CVE-2025-27078, CVE-2025-27079 Release Date 2025-04-08 Affected Products HPE Aruba Networking - Access Points running AOS-8 Instant - Access Points running AOS-10 AP Affected Software Versions AOS-8: 6.7.x.x, 10.7.0.1 and below AOS-10 AP: 4.4.x.x, 10.4.1.6 and below AOS-8 Instant: 8.2.x.x, 8.12.0.3 and below AOS-8 Instant: 10.3.x.x, 10.3.0.3 and below Vulnerability Details 1. Authenticated Remote Command Execution caused by Insecure Function Usage in System Binary (CVE-2025-27078) - Due to insecure function usage in the system binary, an authenticated remote command execution vulnerability exists in the CLI interface of AOS-8 Instant and AOS-10 AP. - Successful exploitation could allow an attacker to execute arbitrary code on the operating system, potentially leading to full system compromise. 2. Arbitrary File Creation vulnerability allows for Authenticated Remote Code Execution in CLI Interface (CVE-2025-27079) - An arbitrary file creation vulnerability exists in the file creation process within the CLI interface of AOS-8 Instant and AOS-10 AP, allowing authenticated users to perform remote code execution (RCE) on the operating system. - Successful exploitation could enable an attacker to execute arbitrary code on the operating system, potentially resulting in full system compromise. Solution It is recommended to upgrade affected software to the following versions: AOS-10 AP: 10.7.x.x, 10.7.0.2 and above AOS-10 AP: 4.4.x.x, 10.4.1.6 and above AOS-8 Instant: 8.2.x.x, 8.12.0.3 and above AOS-8 Instant: 10.3.x.x, 10.3.0.3 and above Supported Software Versions Only affected versions are listed. For more information, refer to the security vulnerability summary for affected versions.

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba AOS-8/10 AP CLI Authenticated RCE Vulnerabilities (CVE-2025-27078/27079)