CVE-2025-37142
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Risk Assessment
An authenticated attacker can download sensitive files from the system, potentially leading to data leakage and further privilege escalation.
Recommendation
Restrict CLI access, apply the vendor patch, and monitor for unusual file download operations.
Other vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor
Original NVD description (English source)
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS