Filtered by vendor Arubanetworks Subscriptions
Filtered by product Arubaos Subscriptions
Total 213 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-26305 1 Arubanetworks 2 Arubaos, Sd-wan 2026-04-15 9.8 Critical
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-42506 1 Arubanetworks 1 Arubaos 2026-04-15 9.8 Critical
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2024-42507 1 Arubanetworks 1 Arubaos 2026-04-15 9.8 Critical
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2025-27082 1 Arubanetworks 1 Arubaos 2026-02-26 7.2 High
Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.
CVE-2025-37132 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.
CVE-2025-37133 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37134 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37169 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-02-26 7.2 High
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2025-37170 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37171 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37172 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37173 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-02-26 7.2 High
An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.
CVE-2025-37174 2 Arubanetworks, Hpe 2 Arubaos, Arubaos 2026-02-26 7.2 High
Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2025-37175 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-02-26 7.2 High
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system.
CVE-2025-37176 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-02-26 6.5 Medium
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.
CVE-2025-37161 2 Arubanetworks, Hpe 2 Arubaos, Aruba Networking 100 Series Cellular Bridge 2026-02-13 7.5 High
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.
CVE-2025-37162 2 Arubanetworks, Hpe 2 Arubaos, Aruba Networking 100 Series Cellular Bridge 2026-02-13 6.5 Medium
A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVE-2025-37177 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-01-23 6.5 Medium
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.
CVE-2025-37178 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-01-23 5.3 Medium
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.
CVE-2025-37179 3 Arubanetworks, Hp, Hpe 3 Arubaos, Arubaos, Arubaos 2026-01-23 5.3 Medium
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.