CVE-2025-37155: HPE ArubaOS-CX Auth Bypass Vulnerability

CVE-2025-37155 Overview

CVE-2025-37155 is an improper access control vulnerability [CWE-284] in the SSH restricted shell interface of HPE ArubaOS-CX network management services. The flaw allows authenticated users with read-only privileges to escalate to administrator access on the affected system. HPE published a security advisory documenting the issue, and the vulnerability was added to the National Vulnerability Database on November 18, 2025.

Critical Impact
An authenticated read-only user can gain full administrator control of ArubaOS-CX switches, compromising the confidentiality, integrity, and availability of the network device.

Affected Products

HPE ArubaOS-CX (multiple versions — refer to the HPE advisory)
Aruba CX series switches running vulnerable ArubaOS-CX firmware
Network management services exposing the SSH restricted shell interface

Discovery Timeline

2025-11-18 - CVE-2025-37155 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37155

Vulnerability Analysis

The vulnerability resides in the SSH restricted shell interface exposed by ArubaOS-CX network management services. The restricted shell is intended to limit low-privilege operators to a constrained set of read-only commands. Improper access control enforcement in this interface allows an authenticated read-only user to invoke functionality outside the intended privilege boundary. Successful exploitation grants administrator-level access to switch configuration and operational state.

The issue is categorized under CWE-284 (Improper Access Control). Because the attack path requires local access through an authenticated SSH session, the vulnerability is scoped as a local privilege escalation rather than an unauthenticated remote flaw. Once elevated, an attacker can alter network configuration, disable logging, modify routing, or pivot deeper into the managed environment.

Root Cause

The root cause is insufficient authorization checks on commands or subsystems reachable from the restricted shell. Read-only role enforcement is not consistently applied across all interfaces exposed through SSH, allowing operations reserved for administrators to execute in a lower-privileged context.

Attack Vector

Exploitation requires valid read-only credentials and network reachability to the switch management interface over SSH. After authenticating, the attacker interacts with the restricted shell to invoke commands or code paths that bypass role-based access controls. No user interaction is required beyond the attacker's own session. Refer to the HPE Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-37155

Indicators of Compromise

Unexpected configuration changes on ArubaOS-CX switches performed by accounts assigned read-only roles.
SSH sessions from read-only user accounts followed by administrator-level command execution in device logs.
New or modified local user accounts, AAA settings, or SNMP community strings originating from low-privilege sessions.
Disabled or modified logging and audit configurations shortly after a read-only user logs in.

Detection Strategies

Correlate SSH authentication events with subsequent privileged command execution on the same session ID.
Alert on any write, configuration-mode, or configure terminal activity performed by accounts provisioned as read-only.
Baseline normal command patterns for operator-role accounts and flag deviations.

Monitoring Recommendations

Forward ArubaOS-CX syslog and AAA accounting records to a centralized SIEM for role-versus-action correlation.
Enable command accounting on all switches to record every executed command with associated user role.
Monitor management-plane SSH access and restrict source networks through control-plane ACLs.

How to Mitigate CVE-2025-37155

Immediate Actions Required

Apply the fixed ArubaOS-CX firmware version listed in the HPE security advisory to all affected switches.
Audit all accounts assigned read-only or operator roles and remove any that are unnecessary.
Rotate credentials for read-only accounts, particularly any shared or service accounts with SSH access.
Restrict SSH access to the switch management interface to trusted management subnets only.

Patch Information

HPE has published remediation guidance in advisory hpesbnw04888en_us. Administrators should upgrade to the patched ArubaOS-CX release identified in the HPE Security Advisory for their specific hardware platform and branch.

Workarounds

Disable SSH access for read-only accounts where operational workflows permit, forcing use of a monitoring API instead.
Enforce management-plane access control lists that limit SSH connectivity to a dedicated jump host.
Require multi-factor authentication through TACACS+ or RADIUS for all switch logins to raise the bar for credential abuse.
Increase logging verbosity and forward accounting records off-device to detect exploitation attempts.

bash

# Configuration example: restrict SSH management access on ArubaOS-CX
access-list ip MGMT-SSH
    10 permit tcp 10.0.10.0/24 any eq ssh
    20 deny  tcp any any eq ssh
    30 permit any any any

interface mgmt
    apply access-list ip MGMT-SSH in

# Enable command accounting to a remote AAA server
aaa accounting all-mgmt default start-stop group tacacs