CVE-2025-37160

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2025-11-18

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• hpe:arubaos-cx

References

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US

Check your stackJSON