A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects:
- AOS-CX 10.14.xxxx : All patches
- AOS-CX 10.15.xxxx : 10.15.1000 and below
The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.
References
| Link | Resource |
|---|---|
| https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
22 Sep 2026, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hpe arubaos-cx
Hpe aruba Cx 9300s 32p \(s0f83a\) Hpe Hpe aruba Cx 9300 32d \(r9a29a\) Hpe aruba Cx 9300 32d \(r8z96a\) Hpe aruba Cx 9300s 32p \(s0f88a\) Hpe aruba Cx 9300 32d \(r9a30a\) Hpe aruba Cx 9300s 32p \(s0f82a\) Hpe aruba Cx 9300 \(r8z98a\) Hpe aruba Cx 9300s 32p \(s0f81a\) Hpe aruba Cx 9300 \(r8z99a\) Hpe aruba Cx 9300s 32p \(s0f84a\) Hpe aruba Cx 9300s 32p \(s0f87a\) Hpe aruba Cx 9300 \(r9a00a\) Hpe aruba Cx 9300 \(r8z97a\) |
|
| References | () https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US - Vendor Advisory | |
| CPE | cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f81a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f88a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f87a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_\(r9a00a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f83a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_\(r8z97a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_32d_\(r9a30a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f82a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_32d_\(r8z96a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_32d_\(r9a29a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300s_32p_\(s0f84a\):-:*:*:*:*:*:*:* cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_\(r8z98a\):-:*:*:*:*:*:*:* cpe:2.3:h:hpe:aruba_cx_9300_\(r8z99a\):-:*:*:*:*:*:*:* |
Information
Published : 2025-03-18 19:15
Updated : 2026-09-22 19:57
NVD link : CVE-2025-25040
Mitre link : CVE-2025-25040
CVE.ORG link : CVE-2025-25040
JSON object : View
Products Affected
hpe
- aruba_cx_9300s_32p_\(s0f88a\)
- aruba_cx_9300s_32p_\(s0f81a\)
- aruba_cx_9300_\(r9a00a\)
- aruba_cx_9300_\(r8z99a\)
- aruba_cx_9300s_32p_\(s0f87a\)
- aruba_cx_9300_32d_\(r8z96a\)
- aruba_cx_9300_32d_\(r9a30a\)
- arubaos-cx
- aruba_cx_9300s_32p_\(s0f83a\)
- aruba_cx_9300_32d_\(r9a29a\)
- aruba_cx_9300s_32p_\(s0f84a\)
- aruba_cx_9300s_32p_\(s0f82a\)
- aruba_cx_9300_\(r8z97a\)
- aruba_cx_9300_\(r8z98a\)
CWE
CWE-863
Incorrect Authorization