The vulnerability allows an authenticated remote attacker to execute arbitrary shell commands via the web‑based management interface in AOS‑8 and AOS‑10. This can be abused to write or overwrite files on the device’s underlying filesystem, effectively granting the attacker the ability to modify firmware or configuration, inject malicious binaries, or otherwise compromise the integrity of the system. The weakness is a classic command‑injection flaw.

Hewlett Packard Enterprise’s Aruba Networking Wireless Operating System (AOS), specifically versions AOS‑8 and AOS‑10 released on the device web‑management console. No version ranges are specified in the advisory, so any deployment of these OS releases is potentially affected.

The CVSS score of 7.2 indicates a high‑severity flaw, and the EPSS score of < 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation as of the data provided. Attackers would need valid credentials to access the web interface, so the exploitation path requires authenticated access, yet the ability to execute arbitrary commands makes post‑exploitation trivial once compromised.