This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It allows an authenticated remote attacker to perform command injection, enabling arbitrary command execution on the underlying OS. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently provided by the vendor, and no exploits are known in the wild.

Successful exploitation could lead to full compromise of the affected device by allowing an attacker with valid credentials to execute arbitrary commands on the operating system, potentially impacting confidentiality, integrity, and availability of the device and network it manages. The attack requires authenticated access with high privileges, limiting exposure to attackers without credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow vendor updates closely for any released patches or official mitigations.