The ArubaOS command line interface suffers from inconsistent input filtering that permits command injection. This flaw, corresponding to CWE‑78, enables an authenticated remote user to run arbitrary system commands through the restricted shell environment. Because the attacker can execute commands on the underlying OS, the vulnerability can compromise confidentiality, integrity, and availability of the managed access point.

The weakness affects Aruba’s ArubaOS operating system on both AOS‑10 and AOS‑8 Instant access points. All devices that run these firmware releases and expose the CLI to remote management are susceptible. No specific version numbers are listed, so every deployment of AOS‑10 and AOS‑8 Instant should be treated as potentially vulnerable until a patch is applied.

The CVSS score of 7.2 indicates high severity. The EPSS score is not available, so the precise likelihood of exploitation is unknown, and the flaw is not currently listed in the CISA KEV catalog. The attack requires valid credentials to the CLI; once authenticated, the attacker can trivially inject commands, making this a significant risk for networks that allow remote CLI access.