This vulnerability affects the command line interface of ArubaOS Access Points running specified versions of AOS-10 and AOS-8 Instant. An authenticated remote attacker can bypass restrictions in the shell environment to execute arbitrary system commands, classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of affected ArubaOS devices. This can lead to full system compromise, including unauthorized data access, modification, or denial of service. The vulnerability requires authentication but can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the command line interface to trusted administrators only and monitor for suspicious activity. Follow any official guidance from Hewlett Packard Enterprise once published.