This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 10.4.0.0, 10.7.0.0, and 10.8.0.0. An authenticated remote attacker can leverage this flaw to access sensitive files on the underlying OS, leading to the disclosure of confidential system information. The CVSS 3.1 base score is 4.9 (medium severity), with attack vector network, low attack complexity, requiring high privileges, no user interaction, and impact limited to confidentiality. The weakness is categorized under CWE-284 (Improper Access Control). No official patch or remediation level has been published by HPE as of the data provided.

Successful exploitation results in unauthorized disclosure of sensitive system files, which may reveal confidential information about the device configuration or environment. This could enable attackers to plan further attacks or escalate privileges. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, organizations should monitor HPE advisories for updates. Until a patch is available, restrict access to the web-based management interface to trusted administrators and networks to reduce exposure.