CVE-2025-25040
Last modified
CVE-2025-25040 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-25040?
How severe is CVE-2025-25040?
How do I fix CVE-2025-25040?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-25035Improper Neutralization of Input During Web Page Generation …7.3
- CVE-2025-25036Improper Restriction of XML External Entity Reference vulner…6.8
- CVE-2025-25037An information disclosure vulnerability exists in Aquatronic…9.3
- CVE-2025-25038An OS command injection vulnerability exists in MiniDVBLinux…9.8
- CVE-2025-25039A vulnerability in the web-based management interface of HPE…8.8
- CVE-2025-2504Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-25041A vulnerability in the HPE Aruba Networking Virtual Intranet…5.5
- CVE-2025-25042A vulnerability in the AOS-CX REST interface could allow an …4.3
- CVE-2025-25044IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cr…5.4
- CVE-2025-25045IBM InfoSphere Information 11.7 Server authenticated user to…4.3
- CVE-2025-25046IBM InfoSphere Information Server 11.7 DataStage Flow Design…3.7
- CVE-2025-25048IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 throu…6.5
Are you affected by CVE-2025-25040?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST