The vulnerability is a stack-based buffer overflow that allows an attacker with administrative credentials to send crafted requests through the AOS command‑line interface. When these requests are processed by the underlying management services, the buffer overflow can be triggered, enabling the attacker to execute arbitrary code on the underlying operating system. The flaw is a classic stack‑overflow weakness (CWE‑121) and therefore the exploitation can lead directly to privileged code execution on the host.

Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS). Version information is not specified in the CVE data.

The CVSS score of 7.2 indicates a high severity, and the EPSS score is not publicly available, suggesting the exploitation likelihood is not explicitly quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker requires authenticated administrative access to send malicious commands, so the threat is predominantly an internal or insider risk. If such credentials are compromised or misused, the attacker could achieve arbitrary code execution with elevated privileges, compromising the entire host and potentially the network.