A high-severity security vulnerability in Hewlett Packard Enterprise (HPE) Aruba Networking Private 5G Core platform that could allow unauthorized actors to access and download sensitive system files.
The vulnerability, tracked as CVE-2025-37100 affects critical infrastructure components used by enterprises for private 5G network deployments.
With a CVSS score of 7.7, this security flaw poses significant risks to organizations running affected software versions between 1.24.1.0 and 1.25.1.0, potentially exposing confidential data to malicious actors through API exploitation.
The vulnerability resides within the Application Programming Interfaces (APIs) of the HPE Aruba Networking Private 5G Core platform, creating a pathway for unauthorized access to protected system files.
According to the security bulletin released on June 10, 2025, successful exploitation enables attackers to iteratively navigate through the filesystem and ultimately download sensitive information from the compromised system.
The attack vector is classified as network-based with low attack complexity, requiring only low-level privileges and no user interaction, making it particularly concerning for security professionals.
The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates that while the vulnerability primarily impacts confidentiality rather than system integrity or availability, the scope change component suggests potential for lateral movement within network environments.
HPE’s internal penetration testing team discovered this vulnerability during routine security assessments, demonstrating the importance of proactive security testing in enterprise environments.
The company has confirmed that no public exploitation attempts or proof-of-concept code have been identified as of the advisory release date.
| Risk Factors | Details |
| Affected Products | HPE Aruba Networking Private 5G Core 1.24.1.0 to 1.25.1.0 |
| Impact | Unauthorized access to sensitive system files through API exploitation |
| Exploit Prerequisites | Network access, low-privilege credentials, no user interaction |
| CVSS 3.1 Score | 7.7 (High) |
Organizations unable to immediately upgrade their systems can implement a temporary mitigation strategy by disabling Terminal Services through the system’s graphical user interface.
The workaround process involves navigating to System > Services in the upper menu bar and toggling the Terminal service to disabled status or clicking the stop button to halt the service entirely.
While this measure provides interim protection, HPE emphasizes that it should not replace permanent patching with the updated software version.
Security teams should note that the affected Private 5G Core platform components require careful handling during the mitigation process, as disabling services may impact legitimate administrative functions and network management capabilities.
HPE strongly recommends upgrading to Private 5G Core version 1.25.1.1 or higher to resolve the security vulnerability completely.
The company has discontinued support for software versions that have reached their End of Support (EoS) milestone, making timely updates crucial for maintaining a secure posture.
Organizations should also implement network segmentation strategies to ensure API endpoints are accessible only from within trusted local network environments rather than exposing them to broader network access.
Live Credential Theft Attack Unmask & Instant Defense – Free Webinar
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…
Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities…
You can’t detect today's attacks with yesterday’s threat intelligence; that’s how you could briefly formulate…
Microsoft has published a draft Humanist AI Code of Conduct that would prohibit its in-house…