CVE-2025-37125: Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-16 · updated 2026-06-17
Weakness: CWE-284

Description

A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly

Affected products

Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN Gateway: from 9.5.0.0 through 9.5.3.6; from 9.4.0.0 through 9.4.3.7

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US

Get alerted when CVE-2025-37125 or the next vulnerability affects your stack