CVE-2025-37132: Unrestricted Upload of File with Dangerous Type

An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the...

CVE-2025-37138: Improper Neutralization of Special Elements used in a Command

An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an...

CVE-2025-37145: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits...

CVE-2025-37141: Improper Access Control

Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits...

CVE-2025-37133: Improper Neutralization of Special Elements used in a Command

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2025-37143: Improper Access Control

An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits...

CVE-2025-27084

A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting XSS attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the...

CVE-2025-27084: Improper Neutralization of Input During Web Page Generation

A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting XSS attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the...

HPESBNW04845 rev.1 - HPE Aruba Networking AOS-10 and AOS-8 Mobility Conductor, Controllers, and Gateways - Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Arbitrary File Download, Arbitrary File Modification, Cross-Site Scripting XSS, Unauthorized Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 7000 Series...

CVE-2025-27085: Improper Limitation of a Pathname to a Restricted Directory

Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device...

CVE-2025-27083: Improper Neutralization of Special Elements used in a Command

Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying...

CVE-2025-27082: Unrestricted Upload of File with Dangerous Type

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlyin...

HPESBNW04709 rev.1 - HPE Aruba Networking Controller and Gateway-Based AOS Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS Wi-Fi Controllers and Gateways : Please refer to the Affected Products section above under Vulnerability Summary. Affected Products HPE Aruba Networking Mobility...

HPESBNW04640 rev.5 - HPE Aruba Networking Controller and Gateway-Based AOS Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Mobility Controller Software See vulnerability summary for version details. Aruba SD-WAN Software and Gateways See...

HPESBNW04454 rev.5 - HPE Aruba Networking Controller and Gateway-Based AOS Multiple Vulnerabilities

Potential Security Impact: Local: Cross-Site Scripting XSS; Remote: Arbitrary Code Execution, Arbitrary Command Execution, Arbitrary File Deletion, Disclosure of Sensitive Information, Unauthorized Arbitrary Command Execution, Buffer Overflow, Session Reuse SUPPORTED SOFTWARE VERSIONS: ONLY...

PT-2022-24137 · Hewlett Packard +1 · Aruba Mobility Conductor (Formerly Mobility Master); Aruba Mobility Controllers; Wlan Gateways/Sd-Wan Gateways Managed By Aruba Central +3

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this issue...

Vulnerabilities fixed in ArubaOS and SD-WAN

Aruba Networks has fixed vulnerabilities in ArubaOS and Aruba Mobility Conductor formerly Mobility Master which are used in various Aruba Networks access points. A malicious party can exploit the vulnerabilities to execute arbitrary code on the vulnerable system. execute arbitrary code on the...