This vulnerability involves command injection in the CLI service of HPE Aruba Networking Wireless Operating System accessed via the PAPI protocol. Successful exploitation requires authentication and allows remote execution of arbitrary OS commands, impacting confidentiality, integrity, and availability. Affected versions include multiple releases of AOS-8 and AOS-10. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by HPE as of the publication date.

If exploited, an authenticated remote attacker could execute arbitrary commands on the underlying operating system of affected HPE Aruba Networking devices. This could lead to full compromise of the device, including unauthorized access to sensitive information, modification or deletion of data, and disruption of network services. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by HPE, organizations should restrict access to the CLI service and PAPI protocol interfaces to trusted administrators only. Monitor for unusual activity from authenticated users and apply network-level controls to limit exposure. Follow HPE advisories closely for updates on patches or mitigations.