An authenticated low‑privileged user can run arbitrary operating‑system commands through vulnerable CLI operations, thereby escalating privileges to a privileged user. The flaw permits the attacker to inject any command that the underlying OS would execute, providing complete control over the device and its data. Such a vulnerability can compromise confidentiality, integrity, and availability of the network segment protected by the device.

The vulnerability affects Hewlett Packard Enterprise AOS‑CX devices. No specific version range is supplied in the current advisory, so all instances of AOS‑CX that expose the vulnerable command‑line interface are potentially impacted. Administrators should consult the vendor documentation to confirm whether their deployment includes the affected operations.

With a CVSS score of 8.8 the flaw is classified as high severity. The EPSS score is currently unavailable, which limits precise exploitation probability estimates, and the flaw is not listed in the CISA KEV catalog. Attack requires valid credentials for a low‑privileged account on the device, but once authenticated the attacker can execute privileged commands. The lack of a publicly disclosed exploit does not negate the risk, as the vulnerability itself enables local code execution with elevated privileges.