The vulnerability arises from improper handling of XML External Entities in the DHCP component of ArubaOS AOS‑8. An unauthenticated remote attacker, by sending crafted XML data, can trigger excessive memory or CPU consumption. This results in a denial‑of‑service that may shut down or slow the DHCP service, reducing the availability of network access points and connected devices.

The flaw affects Hewlett Packard Enterprise's ArubaOS (AOS) DHCP services, specifically access points running ArubaOS Instant 8.x.x.x. No other HPE products or older ArubaOS versions are mentioned as impacted.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve unauthenticated, remote requests to the DHCP service over the network. Successful exploitation requires only an ability to send XML payloads to the DHCP service; no privileged or authenticated access is needed. Once triggered, the denial‑of‑service can persist until the service is restarted or the firmware updated.