This vulnerability affects multiple versions of HPE Aruba Networking Wireless Operating System (AOS), specifically versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It involves command injection in the web-based management interface, allowing an attacker with valid authentication to execute arbitrary OS commands remotely. The CVSS v3.1 score of 7.2 indicates high severity due to network attack vector, low attack complexity, required high privileges, and impacts on confidentiality, integrity, and availability. The vendor has not published any patch or official remediation level, and no known exploits have been reported in the wild.

Successful exploitation could lead to full compromise of the affected system's operating system through arbitrary command execution by an authenticated remote attacker. This impacts confidentiality, integrity, and availability of the device and potentially the network it manages. The vulnerability requires authentication, which limits exposure to attackers who have valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Do not expose the management interface to untrusted networks. Follow vendor channels for updates on patches or official mitigations.