Vulnerability

CERT-In Vulnerability Note CIVN-2025-0068
Multiple Vulnerabilities in Hewlett Packard Enterprise Product (Aruba)

Original Issue Date:April 04, 2025

Severity Rating: HIGH

Software Affected

HPE Aruba Networking Virtual Intranet Access (VIA) Client prior to 4.7.0

Overview

Multiple Vulnerabilities have been reported in HPE Aruba which could be exploited by an attacker to gain unauthorized access, execute arbitrary code and cause denial service (DOS) condition on the targeted system

Target Audience:
System admins, security teams, and end-users seeking secure, scalable networking solutions.

Impact Assessment:
Potential to Data Manipulation and arbitrary code execution.

Description

Remote Code Execution

This vulnerability exists in the network configuration service of the DHCP protocol. An unauthenticated remote attacker could exploit this vulnerability by intercepting VPN traffic.
Successful exploitation could allow an attacker to execute Remote Code on the targeted system.

DDOS

This vulnerability exists in HPE Aruba Networking Virtual Intranet Access (VIA)client. An attacker could exploit this vulnerability by overwrite arbitrary files as NT AUTHORITY\SYSTEM (root).
Successful exploitation could allow an attacker to cause Denial-of-Service (DoS) condition on the targeted system.

Solution

Apply appropriate updates as mentioned in the Hewlett Packard Enterprise Security Bulletin.
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04841en_us&docLocale=en_US

Vendor Information

HPE Aruba
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04841en_us&docLocale=en_US

References

HPE Aruba
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04841en_us&docLocale=en_US
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04841en_us&docLocale=en_US

CVE Name
CVE-2025-25041
CVE-2024-3661

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India