CVE-2025-27082 Authenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlyin...

CVE-2025-27082 Authenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlyin...

CVE-2025-27082

The CVE-2025-27082 entry concerns an Arbitrary File Write vulnerability in the web-based management interfaces of HPE AOS-10 GW and AOS-8 Controller/Mobility Conductor. Affected component: the web UI backend for AOS-10 GW and AOS-8 Controller/Mobility Conductor. Root cause: ability for an authent...

CVE-2025-27079

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-27078

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise...

CVE-2025-27079

CVE-2025-27079 affects HPE AOS-8 Instant and AOS-10 AP CLI file creation. A vulnerability in the file creation process could allow an authenticated remote attacker to perform remote code execution (RCE), enabling execution of arbitrary OS commands on the underlying host and potential system compr...

CVE-2025-27078

CVE-2025-27078 affects HPE AOS-8 Instant and AOS-10 AP — a vulnerability in a system binary that could allow an authenticated remote attacker to inject commands into the underlying operating system via the CLI, potentially leading to complete system compromise. The NVD/NVD-derived metrics indicat...

CVE-2025-27078 Authenticated Remote Command Execution caused by Insecure Function Usage in System Binary

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise...

PT-2025-15472

Name of the Vulnerable Software and Affected Versions: AOS-10 GW versions prior to 10.7.1.0 AOS-8 Controller/Mobility Conductor versions prior to 8.10.0.15 and 8.12.0.3 Description: A vulnerability in the Captive Portal could allow a remote attacker to conduct a reflected cross-site scripting XSS...

PT-2025-15471

Name of the Vulnerable Software and Affected Versions: AOS-10 GW versions prior to 10.7.1.0 AOS-8 Controller/Mobility Conductor versions prior to 8.12.0.3 Description: The issue is related to authenticated command injection vulnerabilities in the web-based management interface of the affected...

PT-2025-15460 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant affected versions not specified AOS-10 AP versions up to 8.10.0.15 AOS-10 AP versions up to 8.12.0.3 AOS-10 AP versions up to 10.4.1.5 AOS-10 AP versions up to 10.7.0.1 Description: A vulnerability in a system binary could allow...

PT-2025-15470

Name of the Vulnerable Software and Affected Versions: AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description: Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8...

Oracle Linux 8 : tomcat (ELSA-2025-3683)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3683 advisory. - Resolves: RHEL-82934 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2025-24813 Tenable has...

PT-2025-15473

Name of the Vulnerable Software and Affected Versions: AOS-10 GW affected versions not specified AOS-8 Controller/Mobility Conductor affected versions not specified Description: Multiple vulnerabilities exist in the web-based management interface of the affected devices. Successful exploitation o...

PT-2025-15461 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant versions prior to the fixed version AOS-10 AP versions prior to the fixed version Description: A vulnerability in the file creation process on the command line interface could allow an authenticated remote attacker to perform...

Oracle Linux 8 : libxslt (ELSA-2025-3615)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3615 advisory. - Fix CVE-2024-55549 RHEL-83506 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessu...

AlmaLinux 8 : libxslt (ALSA-2025:3615)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:3615 advisory. libxslt: Use-After-Free in libxslt numbers.c CVE-2025-24855 libxslt: Use-After-Free in libxslt xsltGetInheritedNsList CVE-2024-55549 Tenable has extracted...

RHEL 8 : firefox (RHSA-2025:3581)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:3581 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

RHEL 8 : freetype (RHSA-2025:3382)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3382 advisory. FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs...

RHEL 8 : firefox (RHSA-2025:3582)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:3582 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...