This vulnerability involves SQL injection flaws in multiple service components of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 10.8.0.0. The injection points are accessible through the AOS-8 and AOS-10 command-line interface and management protocol. Exploitation requires authenticated administrative access. Successful exploitation could lead to arbitrary command execution on the underlying OS, impacting system confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on all security properties. Currently, there is no vendor-provided patch or remediation information available.

An attacker with administrative privileges can exploit SQL injection vulnerabilities to execute arbitrary commands on the underlying operating system. This could lead to full compromise of the affected device, including unauthorized data access, modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to command-line and management protocol usage. Avoid exposing management interfaces to untrusted networks.