Aruba Security Updates – 19 November 2025

The addressed vulnerabilities could allow the attacker to gain elevated privileges, perform denial-of-service attacks, conduct command injection attacks, hijack user sessions, or execute arbitrary code on the affected system.

Sample of the addressed vulnerabilities:

1. Aruba AOS-CX Network Management Interface Privilege Escalation Vulnerability (CVE-2025-37155):

• CVSS: 7.8
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

2. Aruba 100 Series Cellular Bridge Unauthenticated Remote Denial-of-Service Vulnerability (CVE-2025-37161):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

The affected products:

• HPE Aruba Networking CX Switch Series running AOS-CX.
• HPE Aruba Networking 100 Series Cellular Bridge.
• HPE Aruba Networking Management Software (AirWave).