CVE-2025-37158

High · 8.8

CVSS

8.8

EPSS

0.6%

Published

Nov 18, 2025

CISA due date

—

The record

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.

Affected packages

Ecosystem	Package	Introduced	Fixed