This vulnerability involves SQL injection flaws in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0, 8.12.0.0, 8.13.0.0, 10.4.0.0, 10.7.0.0, and 10.8.0.0. The injection points are accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An attacker with administrative privileges can supply crafted input that is not properly sanitized before being used in backend database queries. Successful exploitation could lead to arbitrary command execution on the underlying operating system, impacting confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator-level attacker to execute arbitrary commands on the underlying operating system, which can lead to full system compromise. The CVSS v3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity. Avoid using affected versions where possible and apply updates promptly once available.