CVE-2025-25039

Medium

Published: 04 February 2025

Published

04 February 2025

Modified

28 March 2025

KEV Added

—

Patch

—

CVSS Score 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0021 42.4th percentile

Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25039 is a medium-severity OS Command Injection (CWE-78) vulnerability in Arubanetworks Clearpass Policy Manager. Its CVSS base score is 4.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Applying vendor patches directly remediates the OS command injection vulnerability in the ClearPass Policy Manager web management interface.

SI-10 Information Input Validation good match

prevent

Validating inputs to the web-based management interface prevents OS command injection exploits by authenticated users.

AC-6 Least Privilege partial match

prevent

Enforcing least privilege limits the impact of arbitrary command execution to lower-privileged operations even if the vulnerability is exploited.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

OS command injection in web management interface enables exploitation of public-facing app (T1190) and arbitrary command execution via Unix shell (T1059.004) on the host.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a…

lower privileged user on the underlying operating system.

Deeper analysisAI

CVE-2025-25039 is a vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM). It allows remote authenticated users to run arbitrary commands on the underlying host, stemming from an OS command injection issue classified as CWE-78. The vulnerability has a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

Remote authenticated users with high privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables the attacker to execute arbitrary commands as a lower-privileged user on the underlying operating system, resulting in limited impacts to confidentiality, integrity, and availability.

The HPE security advisory provides details on mitigation and patches at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US.