This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It arises from improper input validation in the certificate download functionality, enabling an authenticated remote attacker to overwrite arbitrary files on the underlying OS by manipulating the file path parameter. This can lead to remote code execution with privileged user access. The CVSS v3.1 base score is 7.2, indicating high severity. The vulnerability requires authentication and no user interaction, with network attack vector and low attack complexity. As of the published date, no official remediation or patch has been disclosed by HPE.

An authenticated attacker can exploit this vulnerability to overwrite arbitrary files on the underlying operating system and execute arbitrary commands with privileged user rights. This can compromise the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the potential for significant impact if exploited. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Do not expose the management interface to untrusted networks. Follow any future guidance from Hewlett Packard Enterprise regarding updates or mitigations.