An unauthenticated attacker can send specially crafted network messages to the protocol‑handling component of HPE Aruba Networking Wireless Operating System (AOS) versions 8 and 10. Because the component lacks sufficient input validation, malformed messages can terminate a critical system process, resulting in a denial‑of‑service condition. The flaw is a potential resource exhaustion issue (CWE‑400).

The vulnerability affects all deployments of HPE Aruba Networking Wireless Operating System AOS 8 and AOS 10 that have not applied the vendor’s fix. No specific minor or patch version is listed, so any installation of AOS 8 or AOS 10 that includes the unpatched protocol handler is considered vulnerable. The impact concerns the critical system process responsible for network protocol handling, which is shared across all models supporting these operating systems.

The CVSS score of 7.5 indicates a high severity. Based on the description, it is inferred that an unauthenticated attacker could send crafted network messages to the vulnerable service over any open network interface, potentially terminating a critical system process and causing a denial‑of‑service. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a vulnerability in the CISA KEV catalog suggests it is not widely known as an actively exploited weakness.