Injection of arbitrary operating‑system commands is possible through the AOS web‑management interface when the attacker is authenticated. The flaw permits complete takeover of the device’s OS, exposing data, enabling persistent footholds, and allowing denial‑of‑service actions. The weakness corresponds to improper validation of command wrappers as described by CWE‑78.

The vulnerability affects Hewlett Packard Enterprise’s Aruba Networking Wireless Operating System, specifically versions AOS‑8 and AOS‑10. No detailed patch levels are published in the advisory, so administrators should verify against the latest firmware released for these OS branches.

The CVSS score of 7.2 indicates a high severity, and while EPSS data is not available, the remote authenticated nature of the exploit combined with the ability to run arbitrary code gives a serious risk. The issue is not listed in CISA KEV, but the high impact and potential to bypass normal controls make it a priority for mitigation. Exploitation requires valid credentials to the management interface, suggesting that access control and network segmentation are critical defensive measures.