CVE-2025-23052 - Vulnerability Details - OpenCVE

Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US

History

Thu, 23 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-77

Wed, 15 Jan 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Jan 2025 17:45:00 +0000

Type	Values Removed	Values Added
Description		Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Title		Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface
References		https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2025-01-14T17:38:43.844Z

Updated: 2025-01-23T21:14:36.522Z

Reserved: 2025-01-10T16:27:25.924Z

Link: CVE-2025-23052

Vulnrichment

Updated: 2025-01-15T15:00:52.219Z

NVD

Status : Awaiting Analysis

Published: 2025-01-14T18:16:05.960

Modified: 2025-01-23T22:15:16.133

Link: CVE-2025-23052

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23052", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-01-10T16:27:25.924Z", "datePublished": "2025-01-14T17:38:43.844Z", "dateUpdated": "2025-01-23T21:14:36.522Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HPE Aruba Networking AOS", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.4.1.4", "status": "affected", "version": "10.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0.2", "status": "affected", "version": "8.12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.10.0.14", "status": "affected", "version": "8.10.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Erik de Jong (bugcrowd.com/erikdejong)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Authenticated command injection vulnerability in the command </span><span style=\"background-color: rgb(255, 255, 255);\">line interface of a network management service. Successful </span><span style=\"background-color: rgb(255, 255, 255);\">exploitation of this vulnerability could allow an attacker to execute </span><span style=\"background-color: rgb(255, 255, 255);\">arbitrary commands as a privileged user on the underlying </span><span style=\"background-color: rgb(255, 255, 255);\">operating system.</span><br>"}], "value": "Authenticated command injection vulnerability in the command\u00a0line interface of a network management service. Successful\u00a0exploitation of this vulnerability could allow an attacker to execute\u00a0arbitrary commands as a privileged user on the underlying\u00a0operating system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-01-14T17:38:43.844Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04723", "discovery": "EXTERNAL"}, "title": "Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-15T15:00:50.936408Z", "id": "CVE-2025-23052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-23T21:14:36.522Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-15T15:00:50.936408Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T15:00:52.219Z"}}], "cna": {"title": "Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface", "source": {"advisory": "HPESBNW04723", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Erik de Jong (bugcrowd.com/erikdejong)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking AOS", "versions": [{"status": "affected", "version": "10.4.0.0", "versionType": "semver", "lessThanOrEqual": "10.4.1.4"}, {"status": "affected", "version": "8.12.0.0", "versionType": "semver", "lessThanOrEqual": "8.12.0.2"}, {"status": "affected", "version": "8.10.0.0", "versionType": "semver", "lessThanOrEqual": "8.10.0.14"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Authenticated command injection vulnerability in the command\u00a0line interface of a network management service. Successful\u00a0exploitation of this vulnerability could allow an attacker to execute\u00a0arbitrary commands as a privileged user on the underlying\u00a0operating system.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Authenticated command injection vulnerability in the command </span><span style=\"background-color: rgb(255, 255, 255);\">line interface of a network management service. Successful </span><span style=\"background-color: rgb(255, 255, 255);\">exploitation of this vulnerability could allow an attacker to execute </span><span style=\"background-color: rgb(255, 255, 255);\">arbitrary commands as a privileged user on the underlying </span><span style=\"background-color: rgb(255, 255, 255);\">operating system.</span><br>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-01-14T17:38:43.844Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23052", "state": "PUBLISHED", "dateUpdated": "2025-01-23T21:14:36.522Z", "dateReserved": "2025-01-10T16:27:25.924Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-01-14T17:38:43.844Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}