CVE-2025-37160 — Authenticated Broken Access Control (BAC) in REST API Configuration Service

CVE-2025-37160

Authenticated Broken Access Control (BAC) in REST API Configuration Service PUBLISHED

Description (CNA)

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data.

Affected (CNA)

Vendor / product	Versions
Hewlett Packard Enterprise (HPE) / HPE Aruba Networking AOS-CX	affected 10.16.0000 through 10.16.1000; affected 10.15.0000 through 10.15.1020; affected 10.14.0000 through 10.14.1050; affected 10.13.0000 through 10.13.1090; affected 10.10.0000 through 10.10.1160

CWE

No CWE identifiers supplied.

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.