This vulnerability involves SQL injection (CWE-89) in several underlying service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. Authenticated administrators can inject crafted input into parameters that are not properly sanitized before being used in backend database queries. Successful exploitation could lead to arbitrary command execution on the device's operating system, potentially compromising device integrity and confidentiality. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. As of the published date, no patch or official remediation level has been provided by HPE, and no known exploits have been observed in the wild.

If exploited, this vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying operating system of affected HPE Aruba Networking Wireless OS devices. This could lead to full compromise of the device, including unauthorized access, data manipulation, or disruption of wireless network services. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by HPE, organizations should monitor HPE advisories closely for updates. In the meantime, restrict administrative access to trusted personnel only and consider additional network-level controls to limit exposure of management interfaces. Avoid using affected versions if possible until a patch or official mitigation is available.