An authenticated attacker can exploit improper input validation in the certificate download function of the AOS-8 and AOS-10 web‑based management interface to overwrite arbitrary files on the underlying operating system. This flaw, identified as CWE‑296, enables the attacker to target critical system files, allowing the execution of arbitrary commands as a privileged user, which compromises confidentiality, integrity, and availability of the device.

The vulnerability affects Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions AOS‑8 and AOS‑10. All devices running these OS releases are potentially exposed.

The CVSS score of 7.2 indicates high severity, but the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possess valid credentials for the web interface; once authenticated, the attacker can send a crafted request that manipulates the file path parameter to overwrite files and trigger command execution. The attack vector is therefore an authenticated remote web‑interface exploit, likely performed over HTTPS.