A buffer overflow exists in the command line interface of HPE AOS‑CX. An attacker who can authenticate and use the CLI could trigger the overflow, leading to arbitrary code execution with privileges equal to or greater than the underlying operating system. The vulnerability is a classic CWE‑120, where an overflow can compromise confidentiality, integrity, or availability by allowing code to run with high privilege.

This vulnerability affects Hewlett Packard Enterprise's AOS‑CX network operating system. No specific product versions were listed in the advisory, so all deployments of AOS‑CX that rely on the CLI are potentially impacted until an official fix is applied.

The CVSS score of 7.2 rates it as moderately high severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. Since it is not in the CISA KEV catalog, there are no known widespread attacks yet. The attack appears to require remote authenticated access with elevated privileges, which may be limited in many environments, further reducing the risk.