-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 HPE Aruba Networking Product Security Advisory ============================================== Advisory ID: HPESBNW04992 CVE: CVE-2025-37181, CVE-2025-37182, CVE-2025-37183, CVE-2025-37184, CVE-2025-37185 Publication Date: 2026-Jan-13 Last Updated: 2026-Jun-25 Status: Confirmed Severity: Critical Revision: 4 Title ===== Multiple Vulnerabilities in HPE Aruba Networking EdgeConnect SD-WAN Orchestrator Overview ======== HPE Aruba Networking has released patches for EdgeConnect SD-WAN  Orchestrator that addresses multiple security vulnerabilities.  Affected Products ================= HPE Aruba Networking EdgeConnect SD-WAN Orchestrator - EdgeConnect SD-WAN Orchestrator 9.6.x: 9.6.0 - EdgeConnect SD-WAN Orchestrator 9.5.x: 9.5.5 and below - EdgeConnect SD-WAN Orchestrator 9.4.x: 9.4.7 and below NOTE: - EdgeConnect SD-WAN Orchestrator 9.3.x was declared End of Maintenance as of June 30, 2025. All builds of this version are affected unless otherwise noted. - EdgeConnect SD-WAN Orchestrator 9.2.x - all builds of this version and older - are affected and are End of Maintenance. Versions of HPE Aruba Networking EdgeConnect SD-WAN Orchestrator that are end of life are affected by these vulnerabilities unless otherwise indicated. Unaffected Products ================= Any other HPE Aruba Networking products not specifically listed above are not affected by these vulnerabilities. Details ======= Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention (CVE-2025-37184) - ----------------------------------------------------------------------------- A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi- factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system. Internal References: VULN-60 Severity: Critical CVSSv3.1 Base Score: 9.8 CVSS3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Discovery: This vulnerability was discovered and reported by Nicholas Starke of Aruba Threat Labs Note: In addition to the releases listed in the resolution section fixes for this specific vulnerability have also been added to: - EdgeConnect SD-WAN Orchestrator versions 9.3.6 and above - EdgeConnect SD-WAN Orchestrator versions 9.4.3 and above Workaround: None Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface (CVE-2025-37181, CVE-2025-37182, CVE-2025-37183) - --------------------------------------------------------------------------- Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation. Internal References: VULN-61, VULN-62, VULN-63, VULN-70 Severity: High CVSSv3.1 Base Score: 7.2 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Discovery: These vulnerabilities were discovered and reported by moonv through HPE Aruba Networking's Bug Bounty program Workaround: To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Aruba Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage. As a best practice, it is recommended to configure IP-allow- listing for Orchestrator local users and API keys. Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration Interface (CVE-2025-37185) - --------------------------------------------------------------------------- Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface and thereby make unauthorized arbitrary configuration changes to the host. Internal References: ATLSP-135, ATLSP-137, ATLSP-141, ATLSP-142, ATLSP-144, ATLSP-145, ATLSP-146, ATLSP-147, VULN-67, VULN-68, VULN-71, VULN-146 Severity: Medium CVSSv3.1 Base Score: 5.5 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Discovery: This vulnerability was discovered and reported by m0x_noob through HPE Aruba Networking's Bug Bounty program Workaround: To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Aruba Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage. As a best practice, it is recommended to configure IP-allow- listing for Orchestrator local users and API keys. Resolution ========== To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw Workaround ========== Vulnerability specific workarounds are listed per vulnerability above. You may contact HPE Services - HPE Aruba Networking for assistance if needed. For more information, please visit HPE Aruba Networking Support Portal at https://networkingsupport.hpe.com/home Exploitation and Public Discussion ================================== HPE Aruba Networking has been made aware of public exploitation attempts being made against CVE-2025-37184. Immediate action is strongly recommended. Any unpatched systems potentially affected by this vulnerability should be upgraded as soon as possible to minimize exposure and reduce the risk of compromise. For information on patched software versions, see the Resolution section. Revision History ================ Revision 1 / 2026-Jan-13 / Initial release Revision 2 / 2026-Feb-10 / Updated Resolution Section to include newly released 9.4.8 Revision 3 / 2026-Mar-03 / Updated CVSS 3.1 Base Score and Vector of CVE-2025-37184 Revision 4 / 2026-Jun-25 / Updated Exploitation and Public Discussion in regard to CVE-2025-37184 HPE Aruba Networking SIRT Security Procedures ============================================== Complete information on reporting security vulnerabilities in HPE Aruba Networking products and obtaining assistance with security incidents is available at: http://www.hpe.com/support/security-response-policy For reporting NEW HPE Aruba Networking security issues, email can be sent to aruba-sirt@hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: https://www.hpe.com/info/psrt-pgp-key (c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information -----BEGIN PGP SIGNATURE----- iQHLBAEBCAA1FiEEQT1cq06WWXH+NEKru7x8adyj7A4FAmo77EEXHHNlY3VyaXR5 LWFsZXJ0QGhwZS5jb20ACgkQu7x8adyj7A4iCwv+OyYnTF6Y5SerX+AH/v6T4hYk 6eYTIVbcAVoAXUR8E4Uj24M86RZs1eTJR+UvFgExiB6buoZsOQCrJfQ7DVxnUw8q Gt38W3UxNVMtzYvZneuz7dqNTRjA6W8PuONU4Iwc481ztyRJujP13LzNSua7WuE7 NiAOMfV1cOn3cPi44KhpyOYZ+77hGGVgw4505FXVuzlDKfObQ1U68YtMnJhoH6ga oJ25NZK0yeIx6/yc327sDc2XO38GICBCrQ58IIDBz7TbRsBH6g467+FE5SlRTTVP vfiDVrmK8avK9rzB13ZVO32/NmokI2A1/hgI+E0dpNzfLigHg8Qk+Ri7L5syncCe 24FC3f7rRn33W3XsF2w20eeyxV1DYAYoer00fGjXBu0KoT7t+ejHitlMzQh9oCHq jr6zs7/HS+3u8ADkny3V34mnTstNp780uEQS8ELDfJodHx648By46+0gmQFcnAx6 bLCt0g+G5EOKFmMvPXT9HBO5wPFD/aDi8JyogZ/R =t4Zj -----END PGP SIGNATURE-----