Riskcovery

CVE-2025-37177

Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)

State
Published
Severity
6.5 Medium
Published
Jan 13, 2026
Updated
Jan 13, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:Hhpe

Weaknesses

  • CWE-552 Files or Directories Accessible to External Parties

Affected Products

ProductVersions
ArubaOS (AOS)Hewlett Packard Enterprise (HPE)
  • 10.6.0.0 through 10.7.2.1Affected
  • 10.3.0.0 through 10.4.1.9Affected
  • 8.12.0.0 through 8.13.1.0Affected
  • 8.10.0.0 through 8.10.0.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.