Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) 8 and 10. An attacker who authenticates to the system can inject arbitrary OS commands through the CLI, which can be executed with the privileges of the authenticated user. The weakness is consistent with OS command injection (CWE‑78) and can lead to full compromise of the underlying operating system if sufficient privileges are granted.

Products affected are Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS), specifically AOS‑8 and AOS‑10. Version details are not specified in the available data, so all builds of these operating systems should be considered potentially vulnerable until a vendor patch is applied.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits at the time of this analysis. The likely attack vector is remote and requires authentication via the PAPI protocol, after which an attacker can execute arbitrary commands on the host operating system. The vulnerability exposes a high risk of compromise if adequate defenses are not in place.