AOS-10 Access Points contain an inconsistency in the processing of user input that permits an authenticated attacker to inject and execute system commands. The flaw results in the capability to run arbitrary code on the underlying operating system, compromising confidentiality, integrity, and availability of the device and any network services it hosts. The vulnerability is classified as command injection, enabling full control for an attacker who has legitimate credentials on the device.

Hewlett Packard Enterprise ArubaOS (AOS) version 10 running on Access Point devices is affected. Devices running AOS-8 Instant are explicitly not vulnerable.

The CVSS score of 7.2 highlights the vulnerability as high severity, indicating that an authenticated attacker can gain full command execution on the device. The EPSS score is not available, so the likelihood of exploitation remains uncertain, suggesting the flaw may not be widely targeted yet. The vulnerability is not listed in the CISA KEV catalog, meaning no public exploit has been documented. Based on the description, the attack requires valid credentials on the AP and likely proceeds through the authenticated CLI interface, where improperly filtered configuration commands allow injection of system commands.