CVE-2025-37140
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Risk Assessment
An attacker with CLI access could exfiltrate sensitive files such as configurations, certificates, or credentials, leading to confidentiality and integrity breaches.
Recommendation
Apply vendor updates for AOS-10 GW and AOS-8 Controller/Mobility Conductor and restrict CLI access to trusted, authenticated users only.
Other vulnerabilities in AOS-10 GW / AOS-8 Controller/Mobility Conductor
See all- CVE-2025-37145Medium
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
- CVE-2025-37144Medium
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
- CVE-2025-37132High
An arbitrary file write vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation could allow an authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying OS.
Original NVD description (English source)
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS