CVE-2025-27080

Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement...

CVE-2025-25042

A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized acce...

CVE-2025-25040

A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the ...

CVE-2025-27080

CVE-2025-27080 affects Hewlett Packard Enterprise AOS-CX: vulnerabilities in the AOS-CX command line interface could allow an authenticated remote attacker to expose sensitive information. Exploitation could enable access to services outside the impacted switch, potentially enabling lateral movem...

CVE-2025-27080 Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface

Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement...

CVE-2025-25042

CVE-2025-25042 affects HPE AOS-CX devices via the REST interface. An authenticated, low-privilege user can read encrypted credentials of other users on the switch, exposing sensitive information and potentially enabling further access. The CVSS v3.1 base score is 4.3 (Medium) with network attack ...

CVE-2025-25042 Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface

A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized acce...

CVE-2025-25042 Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface

A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized acce...

CVE-2025-25040 Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches

A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the ...

CVE-2025-25040

CVE-2025-25040 affects HPE Aruba CX 9300 CX-9300 switches running AOS-CX. The issue is in port ACL enforcement on routed ports for egress traffic, allowing bypass of ACLs and potential unauthorized traffic flow. Affected: AOS-CX 10.14.xxxx (all patches) and 10.15.xxxx (10.15.1000 and below). Not ...

Hewlett Packard Enterprise AOS-CX（HPE AOS-CX） 安全漏洞

Hewlett Packard Enterprise AOS-CX HPE AOS-CX is a network operating system for data centers, campuses, and edges from Hewlett Packard Enterprise, Inc. It is used to provide flexible and innovative network services and enhance network performance. A security vulnerability exists in Hewlett Packard...

CVE-2025-29911 CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. A critical heap buffer overflow vulnerability was identified in the...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1)

The version of AOS installed on the remote host is prior to 6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1 advisory. - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for mgroupSize ...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.0.5)

The version of AOS installed on the remote host is prior to 7.0.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.0.5 advisory. - BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-129...

CVE-2025-23051

An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files...

CVE-2025-23051

CVE-2025-23051 affects ArubaOS (AOS-8 through AOS-10) — a web-based management interface vulnerability allows an authenticated user to perform parameter injection to overwrite arbitrary system files. Root cause: parameter injection in the authenticated context. Impact: potential compromise of sys...

CVE-2025-23051 Authenticated Remote Code Execution in AOS Web-based Management Interface

An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files...

CVE-2025-23051 Authenticated Remote Code Execution in AOS Web-based Management Interface

An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.6)

The version of AOS installed on the remote host is prior to 6.8.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.6 advisory. - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for mgroupSiz...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.0.5)

The version of AOS installed on the remote host is prior to 6.10.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.0.5 advisory. - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for...