Technical impact
Command injection vulnerabilities exist in the web‑based management interface of HPE Aruba Wireless Operating System versions AOS‑8 and AOS‑10. An authenticated remote attacker who can access the web interface can execute arbitrary operating system commands, yielding full control over the device’s underlying OS. This is a classic remote code execution flaw, reflecting weaknesses in command injection (CWE‑77).
Affected Systems
The affected systems are Hewlett Packard Enterprise Aruba Wireless Operating System AOS‑8 and AOS‑10. No specific affected version range is provided, so all deployed instances of these OS releases are potentially susceptible. Users should verify the model and firmware version against HPE’s advisory to confirm whether their devices are impacted.
Risk and Exploitability
The vulnerability scores a CVSS of 7.2, indicating high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, so public exploitation is not yet documented as widespread. Attackers would first need valid user credentials to log into the web interface; once authenticated, they can send crafted input that is passed directly to the operating system shell. Because the attack vector is remote over the network, the potential impact ranges from compromised device configuration to complete takeover, depending on the privileges of the authenticated user.
