What is CVE-2025-23054?

CVE-2025-23054 is a medium-severity vulnerability in Arubanetworks Fabric Composer, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2025-01-28.

How severe is CVE-2025-23054?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Arubanetworks Fabric Composer

CVE-2025-23054

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.

Vulnerability class: Broken Access Control

EPSS: 0.004 (28.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Arubanetworks Fabric_composer
Hewlett Packard Enterprise (Hpe) Hpe Aruba Networking Fabric Composer (Afc) — versions 7.0.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security-alert@hpe.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-23054?: CVE-2025-23054 is a medium-severity vulnerability in Arubanetworks Fabric Composer, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2025-01-28.
How severe is CVE-2025-23054?: Medium severity. CVSS v3 base score is 6.5 out of 10.