Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-37122 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CNA: [email protected]CVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04950en_us&docLocale=en_US	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CISA-ADP

Affected Products

Product	Versions
HPE Aruba Networking ClearPass Policy Manager	>= 6.12, <= 6.12.5 >= 6.11, <= 6.11.12
CPE cpe:2.3:a:hp:aruba_clearpass_policy_manager:::::::: cpe:2.3:a:arubanetworks:clearpass_policy_manager:::::::: Remediation Upgrade: 6.12.6moderate efforthttps://networkingsupport.hpe.com/downloads;fileTypes=SOFTWARE Upgrade: 6.11.12 Hotfix Patch for CVE-2025-37122moderate efforthttps://networkingsupport.hpe.com/downloads;fileTypes=SOFTWARE Workaround:low effort Restrict access to the web-based management interface to a dedicated layer 2 segment/VLAN and/or control access via firewall policies at layer 3 and above.

Product

Versions

HPE Aruba Networking ClearPass Policy Manager

>= 6.12, <= 6.12.5

>= 6.11, <= 6.11.12

CPE

cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*

Remediation

Upgrade: 6.12.6moderate efforthttps://networkingsupport.hpe.com/downloads;fileTypes=SOFTWARE
Upgrade: 6.11.12 Hotfix Patch for CVE-2025-37122moderate efforthttps://networkingsupport.hpe.com/downloads;fileTypes=SOFTWARE
Workaround:low effort
Restrict access to the web-based management interface to a dedicated layer 2 segment/VLAN and/or control access via firewall policies at layer 3 and above.

Change History

5 change records found show changes

Date	Action	Recorded By
Sep 26, 2026	CVE Translated	[email protected]
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Sep 17, 2025	New CVE Received	[email protected]
Sep 17, 2025	CVE Modified	CISA-ADP