CVE-2025-37123 Authenticated Command Injection leads to Unauthorized Actions in CLI Interface

🗓️ 16 Sep 2025 22:30:31Reported by hpeType

Authenticated command injection in HPE Aruba EdgeConnect CLI enables privileged remote code execution as root.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the command-line interface (CLI) of the software-defined networking management hardware from HPE Aruba Networking EdgeConnect SD-WAN allows a attacker to escalate their privileges and execute arbitrary commands.	23 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-37123	19 Sep 202523:56	–	circl
CNNVD	HPE Aruba Networking EdgeConnect SD-WAN Gateways 安全漏洞	16 Sep 202500:00	–	cnnvd
CVE	CVE-2025-37123	16 Sep 202522:30	–	cve
EUVD	EUVD-2025-29661	3 Oct 202520:07	–	euvd
HPE Security Bulletins	HPESBNW04943 rev.2 - HPE Aruba Networking EdgeConnect SD-WAN Gateways, Multiple Vulnerabilities	16 Sep 202500:00	–	hpe
NCSC	Vulnerabilities fixed in HPE Aruba Networking EdgeConnect SD-WAN Gateways	18 Sep 202512:02	–	ncsc
NVD	CVE-2025-37123	16 Sep 202523:15	–	nvd
Positive Technologies	PT-2025-38093	16 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-37123	18 Sep 202523:28	–	redhatcve

[
  {
    "defaultStatus": "affected",
    "product": "HPE Aruba Networking EdgeConnect SD-WAN Gateway",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "lessThanOrEqual": "9.5.3.6",
        "status": "affected",
        "version": "9.5.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.4.3.7",
        "status": "affected",
        "version": "9.4.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
support	www.support.hpe.com/hpesc/public/docDisplay

16 Sep 2025 22:36Current

CVSS 3.18.8

EPSS0.00426