This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It allows an authenticated remote attacker to perform command injection, enabling them to place arbitrary files on the device's filesystem. The CVSS 3.1 score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation level, and no exploits are publicly known.

Successful exploitation could lead to unauthorized file placement on the device, potentially compromising confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the ability to inject commands remotely with authentication, the impact is significant for affected network infrastructure devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity related to management interface usage.