Login Request a demo
Low severity · published Mar 18, 2025
CVE-2025-25040
Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
AOS-CX · Hewlett Packard Enterprise (HPE)
10.14.0000 through <=10.14.1040; 10.15.0000 through <=10.15.1000 · source: vendor
AR
Arubaos-cx · Hpe
10.14.0000 before 10.14.1040; 10.15.0000 before 10.15.1001 · source: NVD
Affected product
AO
AOS-CX
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25040
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US
More from AOS-CX
9.8
CVE-2026-73778
Credential Manager Vulnerability Allows Unauthorized Administrative Access
9.8
CVE-2026-73749
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
9.8
CVE-2026-23813
Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset
8.8
CVE-2026-73782
Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX
8.8
CVE-2026-73763
Unauthenticated Remote Command Execution in Management Component