HPE Aruba AOS-CX Multiple Vulnerabilities Advisory (CVE-2025-37155/37156)

Vulnerability Title HPE Aruba Networking AOS-CX Multiple Vulnerabilities Vulnerability Severity Local: Gain Unauthorized Access Remote: Access Restriction Bypass, Arbitrary Command Execution, Code Execution, Denial of Service (DoS), Directory Traversal, Disclosure of Sensitive Information, Elevated Privileges, Session Reuse Source Hewlett Packard Enterprise, HPE Product Security Response Team Vulnerability Summary HPE Aruba Networking AOS-CX, Multiple Vulnerabilities Vulnerability Details CVE-2025-37155: - Description: Authenticated Privilege Escalation Allows Unauthorized Access in Network Management Interface - Severity: High - Discoverer: Angelo Catalani and Giacomo Gloria from Italian National Cybersecurity Agency (ACN) - Mitigation: Restrict CLI and Web management interfaces to dedicated L2 segments/VLANs or control via L3 and higher-layer firewall policies CVE-2025-37156: - Description: ArubaOS-CX Platform-Level Denial-of-Service Vulnerability - Severity: Medium - Discoverer: Nicholas Starke from HPE Aruba Networking SIRT - Mitigation: Same as above Affected Products HPE Aruba Networking AOS-CX Software Version(s) - AOS-CX 10.16.xxxx: 10.16.1000 and below - AOS-CX 10.15.xxxx: 10.15.1020 and below - AOS-CX 10.14.xxxx: 10.14.1050 and below - AOS-CX 10.13.xxxx: 10.13.1090 and below - AOS-CX 10.10.xxxx: 10.10.1160 and below Remediation Upgrade HPE Aruba Networking AOS-CX to the following versions (as applicable): - AOS-CX 10.16.xxxx: AOS-CX 10.16.1001 and above - AOS-CX 10.15.xxxx: AOS-CX 10.15.1030 and above - AOS-CX 10.14.xxxx: AOS-CX 10.14.1060 and above - AOS-CX 10.13.xxxx: AOS-CX 10.13.1101 and above - AOS-CX 10.10.xxxx: AOS-CX 10.10.1170 and above

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba AOS-CX Multiple Vulnerabilities Advisory (CVE-2025-37155/37156)