This vulnerability affects the web-based management interface of ArubaOS Access Points in specified versions. An unauthenticated attacker within the same local network can exploit a cross-site scripting flaw to execute arbitrary JavaScript in the context of a victim's browser. This can result in theft or compromise of sensitive user data and unauthorized changes to device configurations. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no privileges required but user interaction needed. The vulnerability is tracked as CWE-79. No patch or official remediation level has been published by HPE as of the provided data.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in a victim's browser on the same local network, potentially compromising user data and enabling unauthorized manipulation of device configuration settings. The vulnerability affects confidentiality, integrity, and availability with high severity (CVSS 8.8). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the management interface to trusted users and networks, and consider network segmentation to restrict local network access to management interfaces. Monitor vendor communications for updates on patches or mitigations.