PT-2025-11635 · Aruba · Aos-Cx

Internal Engineering · Published 2025-03-18 · Updated 2025-03-18 · CVE-2025-25040

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AOS-CX versions 10.14.xxxx through 10.15.1000

Description A vulnerability has been identified in the port ACL functionality of AOS-CX software, which could allow an attacker to bypass ACL rules applied to routed ports on egress. This results in port ACLs not being correctly enforced, potentially leading to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this issue.

Recommendations For AOS-CX version 10.14.xxxx, update to a version above 10.14.xxxx to resolve the issue. For AOS-CX version 10.15.xxxx, update to a version above 10.15.1000 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable port ACL functionality until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-25040

Affected Products

Aos-Cx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-25040 · Security Note
• https://twitter.com/CVEnew/status/1902075677979111633 · Twitter Post
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US · Note
• https://t.me/cvedetector/20605 · Telegram Post
• https://t.me/cvetracker/19397 · Telegram Post