This vulnerability involves stack-based buffer overflows in several management service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. The affected components are accessed through the command-line interface. An attacker with administrative privileges can exploit these vulnerabilities by sending specially crafted requests, leading to arbitrary code execution with elevated privileges on the underlying operating system. The CVSS 3.1 base score is 7.2, indicating high severity, with impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-121 (stack-based buffer overflow). As of the published date, no patch or official remediation level has been provided by HPE, and no exploits have been observed in the wild.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary code with elevated privileges on the underlying operating system. This could lead to full compromise of the affected device, impacting confidentiality, integrity, and availability of the system. The high CVSS score reflects the critical nature of the impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to management service components. Avoid exposing the command-line interface to untrusted networks. Follow HPE's official communications for updates on patches or mitigations.