An authenticated remote attacker can inject arbitrary shell commands through the CLI of Aruba Access Points running AOS‑10. This injection vulnerability allows the attacker to execute commands on the underlying operating system, effectively achieving remote code execution. The weakness is an OS Command Injection flaw (CWE‑77).

Affected devices are Aruba Access Points that run AOS‑10.7.x.x and later. Earlier branches (AOS‑10.4 and AOS‑8 Instant) are not impacted.

The CVSS score of 7.2 indicates high severity, while the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials to the CLI, so the attack is limited to authenticated users in the network. Without such credentials the vulnerability cannot be leveraged. As a result, the risk is significant for organizations that expose CLI access to untrusted hosts or lack strong authentication controls.