Cyber Posture

CVE-2025-23060

Medium

Published: 04 February 2025

Published
04 February 2025
Modified
28 March 2025
KEV Added
Patch
CVSS Score 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 26.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23060 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Arubanetworks Clearpass Policy Manager. Its CVSS base score is 6.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Adversary-in-the-Middle (T1557). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires cryptographic protection of confidentiality and integrity for transmitted information, directly preventing cleartext exposure of sensitive data and man-in-the-middle attacks in ClearPass Policy Manager.

prevent

Mandates timely remediation of identified flaws, such as this cleartext transmission vulnerability, to eliminate the root cause and prevent exploitation.

prevent

Ensures authenticity of communications sessions, specifically countering man-in-the-middle attacks enabled by the unencrypted sensitive information exposure.

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Why these techniques?

Cleartext transmission vulnerability (CWE-319) directly facilitates man-in-the-middle attacks for intercepting sensitive data and enabling tampering, as explicitly described.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling…

more

data tampering.

Deeper analysisAI

CVE-2025-23060 is a vulnerability in HPE Aruba Networking ClearPass Policy Manager that may, under certain circumstances, expose sensitive unencrypted information. Classified under CWE-319 (Cleartext Transmission of Sensitive Information), it carries a CVSS v3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-04.

The vulnerability can be exploited over the network by an attacker possessing high privileges (PR:H), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation enables a man-in-the-middle attack, potentially granting unauthorized access to network resources and allowing data tampering, with high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US.

Details

CWE(s)

Affected Products

arubanetworks
clearpass policy manager
6.11.0 — 6.11.10 · 6.12.0 — 6.12.4

CVEs Like This One

CVE-2025-25039Same product: Arubanetworks Clearpass Policy Manager
CVE-2025-23058Same product: Arubanetworks Clearpass Policy Manager
CVE-2026-32309Shared CWE-319
CVE-2026-23809Same vendor: Arubanetworks
CVE-2024-13872Shared CWE-319
CVE-2026-6066Shared CWE-319
CVE-2026-23808Same vendor: Arubanetworks
CVE-2025-37181Same vendor: Arubanetworks
CVE-2025-37174Same vendor: Arubanetworks
CVE-2025-37172Same vendor: Arubanetworks

References