CVE-2025-37144
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
Risk Assessment
The risk includes unauthorized access to sensitive system files, potentially leading to data leakage, system integrity compromise, or privilege escalation.
Recommendation
Apply vendor security patches and restrict access to low-level interfaces to trusted users only.
Other vulnerabilities in AOS-10 GW / AOS-8 Controller/Mobility Conductor
See all- CVE-2025-37145Medium
Arbitrary file download vulnerabilities exist in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. An authenticated attacker could exploit this to download arbitrary files via crafted exploits.
- CVE-2025-37140Medium
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
- CVE-2025-37132High
An arbitrary file write vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation could allow an authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying OS.
Original NVD description (English source)
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS