This vulnerability involves command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. An attacker with valid authentication credentials can remotely execute arbitrary OS commands, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or temporary mitigation, and no known exploits have been reported in the wild.

Successful exploitation allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system, leading to full compromise of the affected device. This can result in complete loss of confidentiality, integrity, and availability of the system running the vulnerable AOS versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.