PT-2025-5614 · Hewlett Packard · Hpe Aruba Networking Clearpass Policy Manager

Daniel Jensen · Published 2025-01-31 · Updated 2025-03-28 · CVE-2025-25039

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: HPE Aruba Networking ClearPass Policy Manager (CPPM) (affected versions not specified)

Description: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. This could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

OS Command Injection

Weakness Enumeration

CWE-287

CWE-78

Related Identifiers

BDU:2025-02352

CVE-2025-25039

Affected Products

Hpe Aruba Networking Clearpass Policy Manager

References · 10

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02352 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25039 · Security Note
• https://vuldb.com/?id.294662 · Note
• https://twitter.com/CVEnew/status/1886848150138192225 · Twitter Post
• https://t.me/cvedetector/17237 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1887040442140656048 · Twitter Post
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US · Note
• https://t.me/cvenotify/116844 · Telegram Post