CVE-2025-37181
Published: 14 January 2026
Summary
CVE-2025-37181 is a high-severity SQL Injection (CWE-89) vulnerability in Arubanetworks Edgeconnect Sd-Wan Orchestrator. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-37181 consists of SQL injection vulnerabilities (CWE-89) in the web-based management interface of EdgeConnect SD-WAN Orchestrator. These flaws enable an authenticated remote attacker to inject and execute arbitrary SQL commands on the underlying database. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-14T17:16:05.497.
An attacker requires high privileges (PR:H) and network access to the management interface to exploit this issue with low complexity and no user interaction. Successful exploitation allows execution of arbitrary SQL commands, potentially resulting in unauthorized data access or manipulation within the database.
The HPE security advisory provides details on mitigation and patches: https://support.hpesc/public/docDisplay?docId=hpesbnw04992en_us&docLocale=en_US.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2455
Vulnerability details
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized…
more
data access or data manipulation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in exposed web management interface directly enables remote exploitation of public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the web management interface to reject malformed SQL syntax before it reaches the database.
Limits the database privileges granted to authenticated management accounts, reducing the impact of any successful SQL injection.
Enables monitoring of database query patterns from the orchestrator interface to identify anomalous SQL statements indicative of injection attempts.