CVE-2025-37163

A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04971en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arubanetworks:airwave:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos ha sido identificada en la interfaz de línea de comandos de la Plataforma HPE Aruba Networking Airwave. Un atacante autenticado podría explotar esta vulnerabilidad para ejecutar comandos arbitrarios del sistema operativo con privilegios elevados en el sistema operativo subyacente.

Information

Published : 2025-11-18 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-37163

Mitre link : CVE-2025-37163

CVE.ORG link : CVE-2025-37163

JSON object : View

Products Affected

arubanetworks

airwave

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-37163", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37163", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T04:55:39.017173Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Management Software (Airwave)", "versions": [{"status": "affected", "version": "8.3.0.0", "versionType": "semver", "lessThanOrEqual": "8.3.0.4"}], "defaultStatus": "affected"}]}], "published": "2025-11-18T19:15:48.290", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04971en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos ha sido identificada en la interfaz de l\u00ednea de comandos de la Plataforma HPE Aruba Networking Airwave. Un atacante autenticado podr\u00eda explotar esta vulnerabilidad para ejecutar comandos arbitrarios del sistema operativo con privilegios elevados en el sistema operativo subyacente."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:airwave:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E151549-B1AC-4E19-9625-0F553BBA7A14", "versionEndExcluding": "8.3.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}