This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It allows an authenticated remote attacker to perform command injection, enabling arbitrary file uploads to the underlying OS. Successful exploitation could lead to remote code execution with privileged user privileges. The CVSS 3.1 base score is 7.2, indicating high severity due to network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch details are currently provided by the vendor.

If exploited, this vulnerability could allow an authenticated attacker to upload arbitrary files and execute commands on the underlying operating system with privileged user rights. This could lead to full compromise of the affected device, including unauthorized access, data manipulation, or disruption of network services managed by the device. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow any additional guidance provided by HPE once available.