This vulnerability exists in the XML handling component of the DHCP services on ArubaOS Instant 8.x Access Points. An unauthenticated remote attacker can exploit this flaw to trigger excessive resource consumption, causing a denial-of-service (DoS) condition. The affected versions include 8.10.0.0, 8.12.0.0, and 8.13.0.0. The CVSS 3.1 base score is 5.3, reflecting medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, and impact limited to availability. No patch or official remediation level has been disclosed by HPE as of the published date.

Successful exploitation results in denial-of-service by causing excessive resource consumption on affected ArubaOS Instant Access Points, leading to service disruption or reduced system availability. There is no impact on confidentiality or integrity reported. The vulnerability requires user interaction and has a high attack complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been disclosed, users should monitor HPE advisories for updates. Until a patch is available, limiting exposure of affected devices to untrusted networks and minimizing user interaction with potentially malicious DHCP responses may reduce risk.