This vulnerability involves SQL injection (CWE-89) in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0, 8.12.0.0, 8.13.0.0, 10.4.0.0, 10.7.0.0, and 10.8.0.0. Authenticated administrators can exploit unsanitized input parameters in the CLI and management protocol to inject SQL commands, which may lead to execution of arbitrary commands on the underlying operating system. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published but lacks vendor-provided remediation details or patches at this time.

Successful exploitation allows an authenticated administrative user to execute arbitrary commands on the underlying operating system via SQL injection, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise of the affected HPE Aruba Networking Wireless Operating System devices. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to CLI and management protocol usage. Avoid exposing management interfaces to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.