CVE-2025-23052: Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-14 · updated 2026-06-17
Weakness: CWE-77

Description

Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Affected products

Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS: from 10.4.0.0 through 10.4.1.4; from 8.12.0.0 through 8.12.0.2; from 8.10.0.0 through 8.10.0.14

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US

Get alerted when CVE-2025-23052 or the next vulnerability affects your stack