An attacker who can authenticate with administrative privileges on the Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) can issue specially crafted requests to management service components accessed through the command-line interface. These requests trigger a stack‑based buffer overflow that allows the attacker to execute arbitrary code on the underlying operating system with elevated privileges, thereby compromising integrity and confidentiality of the system.

The vulnerability affects both AOS‑8 and AOS‑10 operating system releases for HPE Aruba Networking Wireless devices. Users running either of these versions with command‑line access to the PAPI services are potentially exposed.

The CVSS score of 7.2 indicates a high severity. The EPSS score is <1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, but exploitation requires authenticated administrative access, which limits the attack surface to insider or compromised accounts. Once accessed, the buffer overflow enables privilege‑escalating code execution, making this a serious threat for any environment where command‑line control of AOS is permitted.