Command injection vulnerabilities exist in the web‑based management interface of Hewlett Packard Enterprise Aruba Operating System versions AOS‑8 and AOS‑10. An attacker who has authenticated access to the interface can trigger the execution of arbitrary operating‑system commands, potentially affecting confidentiality, integrity, and availability of the device.

The affected product is the Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) for its AOS‑8 and AOS‑10 releases. The CVE targets the web interface of these operating system versions; no specific patch level is identified, so any installation maintaining the vulnerable web interface is at risk.

The CVSS score of 7.2 indicates moderate to high severity, while the EPSS < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is network‑based remote access and requires authenticated credentials, implying that compromised administrative credentials or local administrator access could enable exploitation. Based on the description, it is inferred that an attacker could place malicious commands on the host to gain further authority over the device or surrounding network.