This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It allows an authenticated remote attacker to perform command injection, enabling the upload of arbitrary files to the device's underlying OS. Successful exploitation could lead to remote code execution with privileged user access. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary commands on the affected device with privileged user rights. This could lead to full compromise of the device, including unauthorized access, data manipulation, and disruption of wireless network services. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only, and monitor for any suspicious activity. Avoid exposing the management interface to untrusted networks. Follow HPE's official channels for updates on patches or mitigations.