CVE-2025-37139: Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot

Published Oct 14, 2025

Updated

A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.

Affected Software

1 affected component

Aruba Networks ArubaOS

Event History

Oct 14, 2025

CVE Published

via MITRE·04:58 PM

Data Sourced

via MITRE·04:58 PM

DescriptionSeverity

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access is required to exploit this issue?

An attacker needs local authenticated access with high privileges. The attack does not require user interaction.

Does this vulnerability affect confidentiality or integrity of system data?

The provided impact vector indicates no confidentiality or integrity impact. Its impact is availability: the affected device can be made permanently unbootable.

CVE-2025-37139: Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot

Affected Software

Event History

Frequently Asked Questions

What level of access is required to exploit this issue?

Does this vulnerability affect confidentiality or integrity of system data?

Company

Resources

Contact

Frequently Asked Questions

What level of access is required to exploit this issue?

Does this vulnerability affect confidentiality or integrity of system data?