Aruba Security Updates – 17 July 2025

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, bypass security restrictions, obtain sensitive information, execute arbitrary code, and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. HPE AutoPass License Server Remote Code Execution (CVE-2025-37105):

• CVSS: 7.5
• Attack Vector: Adjacent Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. HPE AutoPass License Server Authentication Bypass (CVE-2025-37107):

• CVSS: 7.3
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

Sample of the affected products:

• HPE Telco Service Orchestrator – Prior to v4.2.4.
• HPE Telco Service Orchestrator – Prior to v5.2.1.