CVE-2025-27084: Arubanetworks ArubaOS XSS Vulnerability

CVE-2025-27084 Overview

CVE-2025-27084 is a reflected cross-site scripting (XSS) vulnerability in the Captive Portal component of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controller/Mobility Conductor devices. A remote unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser within the context of the Captive Portal interface. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Successful exploitation can lead to session token theft, credential harvesting through injected form overlays, or redirection to attacker-controlled infrastructure.

Critical Impact
A remote attacker can execute arbitrary script code in a victim's browser through a crafted Captive Portal request, enabling credential theft and session hijacking against wireless network users.

Affected Products

HPE Aruba Networking AOS-10 Gateway
HPE Aruba Networking AOS-8 Controller
HPE Aruba Networking AOS-8 Mobility Conductor

Discovery Timeline

2025-04-08 - CVE-2025-27084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27084

Vulnerability Analysis

The vulnerability resides in the Captive Portal web interface exposed by ArubaOS on AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors. Captive Portals typically serve as the first point of contact for guest wireless users, presenting a login or acceptance page before granting network access. This attack surface is inherently exposed to untrusted clients, making input sanitization on portal parameters essential.

The Captive Portal fails to properly neutralize user-controlled input before reflecting it back in HTTP responses. An attacker who crafts a URL containing malicious JavaScript payloads can induce the portal to render the payload as active script content. The user interaction requirement (UI:R) means the target must visit the crafted link, but the changed scope (S:C) indicates injected script executes with authority over resources beyond the initially vulnerable component.

Root Cause

The root cause is missing or insufficient output encoding of query string parameters or form inputs handled by the Captive Portal service. When the portal reflects these values into HTML responses without HTML entity encoding or context-aware escaping, browser parsers interpret attacker-supplied markup and JavaScript as legitimate page content.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL to a victim through phishing emails, malicious posts, or a rogue wireless network that redirects clients to the vulnerable Captive Portal endpoint. When the victim loads the URL, the reflected payload executes in the browser under the portal's origin. The attacker can then exfiltrate cookies, inject fake credential prompts, or pivot to other browser-accessible resources.

Detailed technical information is available in the HPE Security Advisory.

Detection Methods for CVE-2025-27084

Indicators of Compromise

HTTP requests to Captive Portal endpoints containing URL-encoded <script>, javascript:, or onerror= payloads in query parameters
Unusual outbound connections from client browsers immediately after Captive Portal interaction, potentially indicating token exfiltration
Web server logs on the Aruba controller showing reflected parameter values matching known XSS payload signatures

Detection Strategies

Deploy web application firewall (WAF) rules in front of Captive Portal interfaces to inspect query strings for script injection patterns
Monitor controller HTTP access logs for anomalous GET requests to /auth/ or captive portal login paths containing encoded angle brackets and event handler attributes
Correlate phishing email indicators referencing internal Captive Portal hostnames or IP addresses with subsequent user browser activity

Monitoring Recommendations

Enable verbose HTTP request logging on AOS-8 and AOS-10 management planes and forward logs to a centralized SIEM for pattern analysis
Alert on Captive Portal responses where request parameters are echoed back unchanged, indicating potential reflection points
Track user-agent and referer headers reaching the Captive Portal to identify traffic originating from external phishing infrastructure

How to Mitigate CVE-2025-27084

Immediate Actions Required

Apply the patched ArubaOS firmware versions listed in the HPE Security Advisory for affected AOS-10 Gateway and AOS-8 Controller/Mobility Conductor deployments
Restrict management and Captive Portal interfaces to trusted network segments where operationally feasible
Educate users and helpdesk staff to avoid clicking Captive Portal links delivered through email or messaging platforms

Patch Information

HPE has published fixed firmware releases through the vendor advisory. Administrators should identify their running AOS-10 or AOS-8 branch and upgrade to the corresponding patched version documented in HPE Security Advisory hpesbnw04845en_us. Reboot and validate portal functionality after upgrade.

Workarounds

Disable the Captive Portal feature if it is not required for guest or authenticated access workflows
Place the Captive Portal behind an upstream reverse proxy or WAF configured to strip or encode reserved HTML characters in request parameters
Implement Content Security Policy (CSP) headers on any proxying layer to limit inline script execution against the portal origin

bash

# Example: disable captive portal profile on AOS-8 controller
(host) [mynode] #configure terminal
(host) [mynode] (config) #aaa authentication captive-portal "default"
(host) [mynode] (Captive Portal Authentication Profile "default") #no enable
(host) [mynode] (Captive Portal Authentication Profile "default") #exit
(host) [mynode] (config) #write memory