The vulnerability is a stack‑based buffer overflow that can be triggered when an authenticated user with administrative privileges issues specially crafted requests via the command‑line interface of the AOS‑8 and AOS‑10 operating systems. When successfully exploited, the attacker can gain execution of arbitrary code with elevated privileges on the underlying operating system, effectively writing the attacker’s own code into memory and executing it. This allows a breach of confidentiality, integrity, and availability for the managed device.

This flaw affects Hewlett Packard Enterprise Aruba Networking Wireless Operating System versions AOS‑8 and AOS‑10. Administrators with CLI or service access on these platforms are at risk, as the services that process the requests run with elevated rights.

The CVSS score of 7.2 indicates high severity. Because the EPSS score is not available, the likelihood of active exploitation is unknown, but the vulnerability is not listed in CISA KEV. The attack requires authenticated administrative privileges, implying the attacker must compromise or have legitimate credentials. Once authenticated, exploitation can be performed remotely via the CLI interface, leading to complete takeover of the device. The lack of a public KEV listing does not reduce the risk; the potential impact remains significant due to the privilege escalation nature of the flaw.