The vulnerability is caused by insecure file operations in the backup functionality of HPE Aruba Networking Fabric Composer, allowing an authenticated attacker to inject arbitrary shell commands and run them on the underlying operating system. This flaw corresponds to CWE‑78, an operating‑system command‑injection weakness. Successful exploitation lets the attacker execute any command with the privileges of the backup process, compromising the device’s confidentiality, integrity, and availability.

The affected product is the HPE Aruba Networking Fabric Composer. No specific version ranges are indicated in the advisory, so all installations of this product are considered potentially vulnerable until a patch is applied.

The CVSS score of 7.2 indicates a high severity level, while the EPSS score of less than 1% means that exploitation is currently unlikely but still possible. The attack requires authenticated access to the backup interface, limiting the attack surface to users with sufficient privileges. Although the vulnerability is not listed in CISA’s KEV catalog, its potential for arbitrary code execution on the operating system warrants prompt action.