SQL injection vulnerabilities in the command‑line interface and management protocol of Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) allow an authenticated administrator to inject unsanitized input into database queries, enabling execution of arbitrary operating‑system commands. The flaw is a classic input‑validation weakness that can be leveraged to compromise system confidentiality, integrity, and availability by running malicious code with elevated privileges.

The affected products are Hewlett Packard Enterprise Aruba Networking Wireless Operating System, specifically versions AOS‑8 and AOS‑10. No additional patch‑level or build information is provided in the advisory.

The CVSS score of 7.2 classifies the vulnerability as high severity. Because the attack requires authenticated access, the attack vector is local or restricted to users who have been granted administrative credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS rating indicates a serious risk if the attacker gains the necessary privileges. Exploitation would involve sending crafted parameters through the command‑line interface or management protocol, with the potential to elevate an attacker’s control over the device. The lack of publicly disclosed exploit code suggests that attacks may be opportunistic but remain credible if credentials are compromised or the device is exposed to a trusted network area.