CVE-2025-37160

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:hpe:arubaos-cx::::::::
	cpe:2.3:o:hpe:arubaos-cx::::::::
	cpe:2.3:o:hpe:arubaos-cx::::::::
	cpe:2.3:o:hpe:arubaos-cx::::::::
	cpe:2.3:o:hpe:arubaos-cx::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de control de acceso roto (BAC) en la interfaz de gestión basada en web podría permitir a un atacante remoto autenticado con privilegios bajos ver información sensible. La explotación exitosa de esta vulnerabilidad podría permitir al atacante divulgar datos sensibles.

Information

Published : 2025-11-18 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-37160

Mitre link : CVE-2025-37160

CVE.ORG link : CVE-2025-37160

JSON object : View

Products Affected

hpe

arubaos-cx

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-37160", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37160", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:56:16.719220Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking AOS-CX", "versions": [{"status": "affected", "version": "10.16.0000", "versionType": "semver", "lessThanOrEqual": "10.16.1000"}, {"status": "affected", "version": "10.15.0000", "versionType": "semver", "lessThanOrEqual": "10.15.1020"}, {"status": "affected", "version": "10.14.0000", "versionType": "semver", "lessThanOrEqual": "10.14.1050"}, {"status": "affected", "version": "10.13.0000", "versionType": "semver", "lessThanOrEqual": "10.13.1090"}, {"status": "affected", "version": "10.10.0000", "versionType": "semver", "lessThanOrEqual": "10.10.1160"}], "defaultStatus": "affected"}]}], "published": "2025-11-18T19:15:48.133", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso roto (BAC) en la interfaz de gesti\u00f3n basada en web podr\u00eda permitir a un atacante remoto autenticado con privilegios bajos ver informaci\u00f3n sensible. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir al atacante divulgar datos sensibles."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FEB3830-A052-4585-BF45-9E221FA06D43", "versionEndExcluding": "10.10.1170", "versionStartIncluding": "10.10.0000"}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0490B2CA-4273-426E-8776-814D242834B0", "versionEndExcluding": "10.13.1101", "versionStartIncluding": "10.13.0000"}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21AC81E3-A4C8-4120-AEEA-46123B84A250", "versionEndExcluding": "10.14.1060", "versionStartIncluding": "10.14.0000"}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB5ADE5E-72CB-41E0-B7A0-08BEBB94ED8E", "versionEndExcluding": "10.15.1030", "versionStartIncluding": "10.15.0000"}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CF58D01-F13F-4DAF-B6A1-D91AEC7F19B3", "versionEndExcluding": "10.16.1001", "versionStartIncluding": "10.16.0000"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}