This vulnerability involves command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. Successful exploitation requires authentication and allows remote execution of arbitrary OS commands, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not published a patch or official remediation details as of the current information.

An authenticated remote attacker could execute arbitrary commands on the underlying operating system of affected HPE Aruba AOS devices. This could lead to full compromise of the device, including unauthorized access to sensitive data, modification or disruption of device operations, and potential pivoting within the network. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.