An authenticated path traversal vulnerability (CWE-22) exists in HPE AOS-CX that allows an attacker with high privileges to copy arbitrary files to a user-readable location from the command line interface of the underlying OS. Successful exploitation could lead to remote code execution. The vulnerability affects versions 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000 of AOS-CX. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An attacker with authenticated access to the AOS-CX command line interface can exploit this path traversal vulnerability to copy arbitrary files to locations accessible by users. This can lead to disclosure of sensitive information and potentially remote code execution, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the command line interface to trusted administrators only and monitor for unusual activity consistent with exploitation attempts.