SQL injection vulnerabilities exist in several service components of the Hewlett Packard Enterprise Aruba AOS-8 and AOS-10 operating systems. An attacker who is able to authenticate with administrative privileges can inject crafted input into command–line interface and management protocol parameters that are passed unsanitized to backend database queries. Successful exploitation can allow the execution of arbitrary commands on the underlying operating system, resulting in full compromise of the device.

The affected products are Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions AOS‑8 and AOS‑10. No specific version numbers are listed in the advisory.

The vulnerability carries a CVSS score of 7.2, indicating a high severity. The EPSS score is not available, but the lack of a KEV listing suggests no documented active exploitation yet. The attack requires local or network access to the device’s management interface and the ability to authenticate with administrative credentials. Once authenticated, the attacker can manipulate database queries leading to remote code execution, which poses a severe threat to confidentiality, integrity, and availability of the managed network infrastructure.