The vulnerability is a classic SQL injection that allows an attacker with administrative privileges to inject crafted parameters into backend database queries via the AOS‑8 and AOS‑10 command‑line interface and management protocol. By exploiting this flaw, the attacker can execute arbitrary operating‑system commands, thereby compromising confidentiality, integrity, and availability of the device. The weakness is identified as SQL injection (CWE‑89).

Hewlett Packard Enterprise’s Aruba Networking Wireless Operating System (AOS) versions AOS‑8 and AOS‑10 are affected. No specific patch or version range is listed, so all releases of these operating systems remain at risk until a vendor patch is applied.

The CVSS score of 7.2 denotes a high severity with a medium to high exploitability. The EPSS score is unavailable, so the precise likelihood of exploitation cannot be quantified, but the vulnerability is not in CISA’s KEV catalog. The attack requires authenticated administrative access, so the vector is likely remote exploitation through the management protocol or CLI over the network. Because the flaw permits arbitrary command execution, the risk to the affected system is substantial, especially in environments where administrative credentials are widely distributed.