This vulnerability involves command injection in the CLI service of HPE Aruba Networking Wireless Operating System (AOS) accessed by the PAPI protocol. It affects multiple versions of AOS-8 and AOS-10. Exploitation requires authentication and allows remote command execution on the device's OS, potentially leading to full compromise. The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring high privileges.

Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system, resulting in complete compromise of the affected device. This could lead to unauthorized access, data manipulation, or disruption of network services managed by the affected wireless operating system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, restrict access to the CLI service and PAPI protocol to trusted administrators only, and monitor for suspicious activity involving these interfaces.