Hewlett Packard Enterprise (HPE) Arubaos (Aos)
34 CVEs affecting Hewlett Packard Enterprise (HPE) Arubaos (Aos). Latest disclosed: 2026-05-12. Critical: 0, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23819 | High | 8.8 | 2026-05-12 | A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execu… |
CVE-2025-37168 | High | 8.2 | 2026-01-13 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation… |
CVE-2026-23823 | High | 7.2 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Succes… |
CVE-2026-23821 | High | 7.2 | 2026-05-12 | A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands u… |
CVE-2026-23820 | High | 7.2 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system… |
CVE-2025-37175 | High | 7.2 | 2026-01-13 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Succe… |
CVE-2025-37174 | High | 7.2 | 2026-01-13 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating s… |
CVE-2025-37173 | High | 7.2 | 2026-01-13 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37169 | High | 7.2 | 2026-01-13 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated… |
CVE-2025-37146 | High | 7.2 | 2025-10-14 | A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform re… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37132 | High | 7.2 | 2025-10-14 | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating syst… |
CVE-2025-37147 | High | 7.1 | 2025-10-14 | A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensu… |
CVE-2025-37177 | Medium | 6.5 | 2026-01-13 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating syst… |
CVE-2025-37176 | Medium | 6.5 | 2026-01-13 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting th… |
CVE-2025-37148 | Medium | 6.5 | 2025-10-14 | A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service att… |