A stack‑based buffer overflow exists in management service components accessed through the command‑line interface of HPE Aruba AOS‑8 and AOS‑10. An attacker who can authenticate with administrative rights can send specially crafted requests that cause the service to execute arbitrary code with the privileges of the underlying operating system. The flaw allows an authenticated user to break out of the intended bounds of the service and run code with elevated privileges, potentially compromising the entire host.

Hewlett Packard Enterprise’s Aruba Networking Wireless Operating System (AOS). Vulnerable components are present in the AOS‑8 and AOS‑10 operating system releases; specific patch levels are not listed in the data.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score of 0.072% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploits yet. Successful exploitation requires authenticated administrative access; the attack vector would be through the locally connected command‑line interface. Given the high impact and lack of known mitigations, the risk is significant for any systems running the affected operating system versions.