Command injection vulnerabilities reside in the web‑based management interface of Hewlett Packard Enterprise Aruba Operating Systems AOS‑8 and AOS‑10. An attacker with valid authenticated credentials can trigger the execution of arbitrary OS commands, potentially giving the attacker full control over the affected device. This breach jeopardizes confidentiality, integrity, and availability of the managed device, and may provide a foothold for further network compromise.

Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions AOS‑8 and AOS‑10 are susceptible. No specific build or patch level is listed; any installation of these OS versions that still presents the vulnerable web interface is at risk.

The vulnerability scores a CVSS of 7.2, indicating moderate to high severity. EPSS data are unavailable, and the flaw is not yet catalogued in CISA KEV, suggesting limited known exploitation but a significant theoretical risk. The likely attack vector is remote and requires authenticated access to the web interface, implying that compromised credentials or local administrator access could enable exploitation. An attacker may use the command injection to launch further attacks against the device and potentially the surrounding network.