This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 10.4.0.0, 10.7.0.0, and 10.8.0.0. It allows an authenticated remote attacker to access sensitive files on the underlying operating system, resulting in confidentiality breaches. The CVSS 3.1 base score is 4.9 (medium severity) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation level has been published by HPE as of the data provided.

Successful exploitation leads to disclosure of confidential system information from the underlying operating system of the affected AOS-10 Gateway device. This could enable attackers to gain insights that facilitate further attacks. The impact is limited to confidentiality with no direct integrity or availability effects reported. The vulnerability requires authenticated access with high privileges, reducing the likelihood of exploitation by low-privilege attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor HPE advisories closely. Until a patch is available, restrict access to the web-based management interface to trusted administrators only and enforce strong authentication controls to limit exposure.