Command Injection in AOS-8 Allows Privileged Command Execution

Publication date: 2026-01-13

Last updated on: 2026-01-13

Assigner: Hewlett Packard Enterprise (HPE)

Description

A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-01-13

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-37176

EUVD

EUVD-2026-2046

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	aos-8	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in AOS-8 that allows an authenticated privileged user to modify a package header to inject shell commands. This means that an attacker with valid credentials and high privileges can execute arbitrary commands within the system, potentially manipulating internal operations.

Impact Analysis

If exploited, this vulnerability could allow an authenticated malicious actor to execute commands with the privileges of the affected mechanism, potentially leading to unauthorized control over system operations and compromising system integrity.

Hi! I’m here to help you understand CVE-2025-37176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70