CVE-2025-25040: Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects:
- AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HPE Aruba Networking CX 9300 Switch Series (AOS-CX)to a version that resolves this vulnerability.Fixed in 10.14.xxxx - Upgrade
Upgrade
HPE Aruba Networking CX 9300 Switch Series (AOS-CX)to a version that resolves this vulnerability.Fixed in 10.15.xxxx
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25040?
CVE-2025-25040 is classified as a high severity vulnerability affecting specific versions of HPE AOS-CX software.
How do I fix CVE-2025-25040?
To fix CVE-2025-25040, upgrade to HPE AOS-CX versions higher than 10.15.1000 or later patches in the 10.14.xxxx series.
Which devices are impacted by CVE-2025-25040?
CVE-2025-25040 specifically impacts the HPE Aruba Networking CX 9300 Switch Series running affected versions of AOS-CX software.
What components of the HPE AOS-CX software are vulnerable due to CVE-2025-25040?
CVE-2025-25040 affects the port ACL functionality within the HPE AOS-CX software.
What actions should I take if I am using an affected version of AOS-CX software?
If using an affected version, it is critical to immediately plan and implement an upgrade to mitigate the risk posed by CVE-2025-25040.