CVE-2025-37159: HPE ArubaOS-CX Auth Bypass Vulnerability

CVE-2025-37159 Overview

CVE-2025-37159 is a session hijacking vulnerability in the web management interface of the HPE AOS-CX operating system. The flaw resides in the user authentication service and allows an authenticated remote attacker to take over an active user session. Successful exploitation enables the attacker to maintain unauthorized access to the session, potentially leading to the disclosure or modification of sensitive configuration data on affected network switches. The vulnerability is tracked under CWE-384: Session Fixation and requires user interaction to exploit.

Critical Impact
An authenticated remote attacker can hijack active administrative sessions on AOS-CX switches, gaining persistent access to view or modify sensitive network configuration data.

Affected Products

HPE ArubaOS-CX (multiple versions, see vendor advisory)
AOS-CX web management interface
HPE Aruba networking switches running AOS-CX

Discovery Timeline

2025-11-18 - CVE-2025-37159 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37159

Vulnerability Analysis

The vulnerability exists in the user authentication service of the AOS-CX web management interface. The interface fails to properly invalidate or rotate session identifiers, enabling an attacker who can influence session state to ride an authenticated user's session. Once the legitimate user authenticates, the attacker reuses the predictable or unrotated session identifier to gain equivalent privileges.

Exploitation requires the attacker to hold low-level credentials on the system and depends on user interaction from a targeted account. The impact covers both confidentiality and integrity of network device configuration, while availability is unaffected. Compromise of a network switch management session can expose VLAN configurations, routing tables, access control lists, and authentication settings.

Root Cause

The root cause is improper session management within the AOS-CX authentication service [CWE-384]. The interface does not generate a new session token upon authentication or does not bind tokens tightly enough to the originating client context. This allows session identifiers obtained or predicted prior to authentication to remain valid after the user logs in.

Attack Vector

The attack is conducted over the network against the AOS-CX web management interface. The attacker must be authenticated to the device and must induce a victim user to interact with a crafted resource or session. Once the victim authenticates, the attacker's preset session identifier becomes a valid authenticated session bound to the victim's privileges.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in prose only; refer to the HPE Security Advisory for vendor-specific technical details.

Detection Methods for CVE-2025-37159

Indicators of Compromise

Concurrent active sessions for the same administrative account originating from different source IP addresses
Unexpected configuration changes on AOS-CX switches outside of approved change windows
Authentication events followed by session activity from a different client fingerprint or user agent
Web management interface session identifiers reused across multiple authentication events

Detection Strategies

Audit AOS-CX show user-list and session logs for anomalous session continuity across IP changes
Correlate web management interface authentication events against source IP, user agent, and geolocation baselines
Monitor for configuration commands executed shortly after authentication from unfamiliar client contexts
Forward AOS-CX syslog and AAA accounting records to a centralized SIEM for behavioral analysis

Monitoring Recommendations

Enable verbose authentication and session logging on all AOS-CX devices and export logs to a centralized platform
Establish baselines for administrator login times, source networks, and session durations
Alert on configuration changes performed via the web management interface, especially to AAA, VLAN, and ACL settings
Review TACACS+ or RADIUS accounting records for session anomalies tied to AOS-CX web logins

How to Mitigate CVE-2025-37159

Immediate Actions Required

Apply the fixed AOS-CX firmware versions listed in the HPE Security Advisory
Restrict access to the AOS-CX web management interface to dedicated management networks and jump hosts
Force logout of all active administrative sessions and rotate administrator credentials after patching
Enable multi-factor authentication for AOS-CX administrators where supported via external AAA

Patch Information

HPE has published a security advisory covering CVE-2025-37159 with fixed firmware versions for affected AOS-CX releases. Administrators should consult the HPE Security Advisory hpesbnw04888en_us for the complete list of fixed versions and upgrade guidance. Update affected switches to the patched release identified for each branch.

Workarounds

Disable the AOS-CX web management interface and manage devices exclusively through SSH and the CLI where operationally feasible
Place the management interface behind a firewall that permits only specific administrator source addresses
Reduce web session timeout values to minimize the window in which a hijacked session remains valid
Require administrators to authenticate through a privileged access management (PAM) gateway that brokers credentials

bash

# Configuration example: restrict AOS-CX web management access
switch(config)# https-server vrf mgmt
switch(config)# no https-server vrf default
switch(config)# https-server session timeout 5
switch(config)# access-list ip MGMT_ACL
switch(config-acl-ip)# 10 permit tcp 10.0.0.0/24 any eq 443
switch(config-acl-ip)# 20 deny tcp any any eq 443
switch(config)# interface mgmt
switch(config-if-mgmt)# ip access-group MGMT_ACL in