CVE-2025-37160 - Vulnerability Details - OpenCVE

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hpe	Arubaos-cx

No data.

No data.

References

Link	Providers
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US

History

Fri, 21 Nov 2025 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hpe Hpe arubaos-cx
Vendors & Products		Hpe Hpe arubaos-cx

Tue, 18 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 18 Nov 2025 19:15:00 +0000

Type	Values Removed	Values Added
Description		A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.
Title		Authenticated Broken Access Control (BAC) in REST API Configuration Service
References		https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2025-11-18T18:54:09.908Z

Updated: 2025-11-18T20:56:20.675Z

Reserved: 2025-04-16T01:28:25.374Z

Link: CVE-2025-37160

Vulnrichment

Updated: 2025-11-18T20:55:35.510Z

NVD

Status : Awaiting Analysis

Published: 2025-11-18T19:15:48.133

Modified: 2025-11-19T19:14:59.327

Link: CVE-2025-37160

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37160", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-04-16T01:28:25.374Z", "datePublished": "2025-11-18T18:54:09.908Z", "dateUpdated": "2025-11-18T20:56:20.675Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "HPE Aruba Networking AOS-CX", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.16.1000", "status": "affected", "version": "10.16.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.15.1020", "status": "affected", "version": "10.15.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.14.1050", "status": "affected", "version": "10.14.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.13.1090", "status": "affected", "version": "10.13.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.10.1160", "status": "affected", "version": "10.10.0000", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "dugisan3rd"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.</p>"}], "value": "A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-11-18T18:54:09.908Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04888", "discovery": "INTERNAL"}, "title": "Authenticated Broken Access Control (BAC) in REST API Configuration Service", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T20:56:16.719220Z", "id": "CVE-2025-37160", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:56:20.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37160", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:56:16.719220Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:55:35.510Z"}}], "cna": {"title": "Authenticated Broken Access Control (BAC) in REST API Configuration Service", "source": {"advisory": "HPESBNW04888", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "dugisan3rd"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking AOS-CX", "versions": [{"status": "affected", "version": "10.16.0000", "versionType": "semver", "lessThanOrEqual": "10.16.1000"}, {"status": "affected", "version": "10.15.0000", "versionType": "semver", "lessThanOrEqual": "10.15.1020"}, {"status": "affected", "version": "10.14.0000", "versionType": "semver", "lessThanOrEqual": "10.14.1050"}, {"status": "affected", "version": "10.13.0000", "versionType": "semver", "lessThanOrEqual": "10.13.1090"}, {"status": "affected", "version": "10.10.0000", "versionType": "semver", "lessThanOrEqual": "10.10.1160"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.", "supportingMedia": [{"type": "text/html", "value": "<p>A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-11-18T18:54:09.908Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37160", "state": "PUBLISHED", "dateUpdated": "2025-11-18T20:56:20.675Z", "dateReserved": "2025-04-16T01:28:25.374Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-11-18T18:54:09.908Z", "assignerShortName": "hpe"}, "dataVersion": "5.2"}