Vulnerability · Published Sep 16, 2025 · Assigned by hpe
CVE-2025-37131Authenticated Arbitrary File Read allows Data Exposure in CLI Interface
Medium 4.9
In plain English
A medium-severity improper access control in HPE Aruba Networking EdgeConnect SD-WAN Gateway from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN Gateway | 9.5.0.0 – through 9.5.3.69.4.0.0 – through 9.4.3.7 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N