CVE-2025-37160: Authenticated Broken Access Control (BAC) in REST API Configuration Service
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37160?
CVE-2025-37160 has been categorized as a broken access control vulnerability, which can lead to the disclosure of sensitive information.
How can I fix CVE-2025-37160?
To remediate CVE-2025-37160, upgrade to a patched version of HPE ArubaOS-CX that addresses the broken access control issues.
Which HPE ArubaOS-CX versions are affected by CVE-2025-37160?
CVE-2025-37160 impacts HPE ArubaOS-CX versions between 10.10.0000 and 10.10.1170, 10.13.0000 and 10.13.1101, 10.14.0000 and 10.14.1060, 10.15.0000 and 10.15.1030, and 10.16.0000 and 10.16.1001.
What type of attacks can CVE-2025-37160 enable?
Exploitation of CVE-2025-37160 can allow an authenticated attacker with low privileges to view sensitive data through the management interface.
Who discovered CVE-2025-37160?
CVE-2025-37160 was reported and documented by security analysts as a vulnerability in HPE ArubaOS-CX.