Command injection vulnerabilities in the web‑based management interface of HPE Aruba AOS‑8 and AOS‑10 allow an authenticated remote attacker to execute arbitrary operating‑system commands. This flaw can be used to compromise the host, elevate privileges, exfiltrate data or launch further attacks once the attacker gains access credentials to the web interface.

Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions 8 and 10 are affected. No specific firmware revisions are listed, but any system running AOS‑8 or AOS‑10 remains vulnerable until a patch is applied.

The CVSS score of 7.2 indicates a high severity vulnerability that can provide an attacker with full control over the affected device. The exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface, requiring authentication; an attacker with valid administrative credentials can trigger the command injection and run arbitrary commands on the device’s operating system.