The vulnerability arises from insufficient input validation within a protocol‑handling component of the HPE Aruba Networking Wireless Operating System. An unauthenticated attacker can send specially crafted network messages to the affected service, causing it to terminate a critical system process and resulting in a denial‑of‑service condition. The flaw enables disruption of service without requiring any authentication or elevated privileges.

This flaw affects Hewlett Packard Enterprise’s HPE Aruba Networking Wireless Operating System, specifically the AOS‑8 and AOS‑10 operating system releases. No specific sub‑versions are listed, but any installations running these OS releases are potentially vulnerable.

The CVSS score of 7.5 indicates a medium‑high severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Likely attack vector is network; the attacker need only reach the service port, no authentication, and can exploit it from an external or internal host that can reach the protocol, making it relatively easy to execute from compromised network devices or remote machines with network access.