CVE-2025-25039
Published: 04 February 2025
Summary
CVE-2025-25039 is a medium-severity OS Command Injection (CWE-78) vulnerability in Arubanetworks Clearpass Policy Manager. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25039 is a vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM). It allows remote authenticated users to run arbitrary commands on the underlying host, stemming from an OS command injection issue classified as CWE-78. The vulnerability has a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Remote authenticated users with high privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables the attacker to execute arbitrary commands as a lower-privileged user on the underlying operating system, resulting in limited impacts to confidentiality, integrity, and availability.
The HPE security advisory provides details on mitigation and patches at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4003
Vulnerability details
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a…
more
lower privileged user on the underlying operating system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in web management interface enables exploitation of public-facing app (T1190) and arbitrary command execution via Unix shell (T1059.004) on the host.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Applying vendor patches directly remediates the OS command injection vulnerability in the ClearPass Policy Manager web management interface.
Validating inputs to the web-based management interface prevents OS command injection exploits by authenticated users.
Enforcing least privilege limits the impact of arbitrary command execution to lower-privileged operations even if the vulnerability is exploited.