This vulnerability involves command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.x and 10.x. Successful exploitation requires authentication and allows an attacker to execute arbitrary commands on the device's operating system, potentially leading to full compromise of the affected device. The vulnerability is rated with a CVSS 3.1 score of 7.2 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Multiple affected versions are identified, but no vendor advisory or patch information is currently available.

An authenticated remote attacker could execute arbitrary commands on the underlying operating system of affected HPE Aruba Networking devices. This could lead to full compromise of the device, including unauthorized access, data manipulation, or disruption of network services. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and consider additional network-level controls to limit exposure. Monitor for any updates from Hewlett Packard Enterprise regarding patches or mitigations.