This vulnerability involves SQL injection in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0, 8.12.0.0, 8.13.0.0, 10.4.0.0, 10.7.0.0, and 10.8.0.0. The injection points are accessible through the AOS command-line interface and management protocol. An attacker with administrative privileges can exploit these injection flaws by sending crafted input that is not properly sanitized before being passed to backend database queries. Exploitation could allow execution of arbitrary commands on the underlying OS, potentially compromising the device. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by HPE as of the data provided.

An authenticated attacker with administrative privileges can exploit this SQL injection vulnerability to execute arbitrary commands on the underlying operating system of affected HPE Aruba Networking Wireless OS devices. This could lead to full compromise of the device, impacting confidentiality, integrity, and availability of the system. The CVSS score of 7.2 indicates a high severity impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for unusual administrative activity. Avoid exposing management interfaces to untrusted networks. Follow HPE's official communications for updates on patches or mitigations.