CVE-2025-37132
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An arbitrary file write vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation could allow an authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying OS.
Risk Assessment
An authenticated attacker could take control of the operating system, potentially leading to full device and network compromise.
Recommendation
Update AOS-10 GW and AOS-8 Controller/Mobility Conductor to the latest versions. Restrict management interface access to trusted administrators only.
Other vulnerabilities in AOS-10 GW / AOS-8 Controller/Mobility Conductor
See all- CVE-2025-37145Medium
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
- CVE-2025-37144Medium
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
- CVE-2025-37140Medium
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Original NVD description (English source)
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS