Command injection vulnerabilities exist in the web‑based management interface of AOS‑8 and AOS‑10 operating systems. An attacker who has valid management credentials can spawn arbitrary operating‑system commands. The resultant breach can lead to full compromise of confidentiality, integrity, and availability of the device and any network services it supports.

Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions 8 and 10 are affected. The vulnerability is tied to the web‑interface management layer of these OS releases.

The CVSS score of 7.2 indicates a moderate to high severity, yet the EPSS score is not available, so the current probability of exploitation is unknown. Because the vulnerability requires authentication, the attacker must first compromise or possess legitimate credentials, but once authenticated the web interface can be accessed remotely, a scenario easily achievable when the management console is exposed to untrusted networks. The vulnerability is not listed in the CISA KEV catalog, suggesting that there are no confirmed widespread exploit campaigns at this time. Nonetheless, an authenticated remote attacker could use this flaw to gain arbitrary command execution, underscoring the importance of timely remediation.