This vulnerability involves SQL injection in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) accessible through AOS-8 and AOS-10 command-line interfaces and management protocols. The flaw arises because certain parameters are passed without proper sanitization to backend database queries. Exploitation requires authenticated administrative access and could lead to arbitrary command execution on the host OS. The affected versions include 8.10.0.0, 8.12.0.0, 8.13.0.0, 10.4.0.0, 10.7.0.0, and 10.8.0.0. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying operating system, potentially compromising system confidentiality, integrity, and availability. This could lead to full system compromise of affected HPE Aruba Networking Wireless Operating System devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Avoid exposing management interfaces to untrusted networks. Follow vendor updates closely for patches or official mitigations.