This vulnerability involves SQL injection flaws in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0, 8.12.0.0, 8.13.0.0, 10.4.0.0, 10.7.0.0, and 10.8.0.0. The injection points are accessible through the CLI and management protocol, requiring administrative authentication. Exploitation allows execution of arbitrary commands on the OS due to unsanitized input passed to backend database queries. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-89 (SQL Injection). No vendor advisory or patch information is currently available.

Successful exploitation could enable an authenticated administrator to execute arbitrary commands on the underlying operating system, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or disruption of network operations managed by the vulnerable AOS devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to CLI and management protocol usage. Avoid exposing management interfaces to untrusted networks.