CVE-2025-37123

🗓️ 16 Sep 2025 22:30:31Reported by hpeType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 18 Views

Authenticated command injection in EdgeConnect SD-WAN gateway CLI enables remote root access.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the command-line interface (CLI) of the software-defined networking management hardware from HPE Aruba Networking EdgeConnect SD-WAN allows a attacker to escalate their privileges and execute arbitrary commands.	23 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-37123	19 Sep 202523:56	–	circl
CNNVD	HPE Aruba Networking EdgeConnect SD-WAN Gateways 安全漏洞	16 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-37123 Authenticated Command Injection leads to Unauthorized Actions in CLI Interface	16 Sep 202522:30	–	cvelist
EUVD	EUVD-2025-29661	3 Oct 202520:07	–	euvd
HPE Security Bulletins	HPESBNW04943 rev.2 - HPE Aruba Networking EdgeConnect SD-WAN Gateways, Multiple Vulnerabilities	16 Sep 202500:00	–	hpe
NCSC	Vulnerabilities fixed in HPE Aruba Networking EdgeConnect SD-WAN Gateways	18 Sep 202512:02	–	ncsc
NVD	CVE-2025-37123	16 Sep 202523:15	–	nvd
Positive Technologies	PT-2025-38093	16 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-37123	18 Sep 202523:28	–	redhatcve

[
  {
    "defaultStatus": "affected",
    "product": "HPE Aruba Networking EdgeConnect SD-WAN Gateway",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "lessThanOrEqual": "9.5.3.6",
        "status": "affected",
        "version": "9.5.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.4.3.7",
        "status": "affected",
        "version": "9.4.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
support	www.support.hpe.com/hpesc/public/docDisplay

17 Jun 2026 09:15Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.8

EPSS0.00426

SSVC

CWE-269