This flaw in the management component of HPE AOS‑CX allows an unauthenticated attacker to execute arbitrary commands. The vulnerability arises from insufficient authentication and improper handling of command inputs, giving the attacker the same privileges as the privileged utility. Successful exploitation grants total control over the affected system, compromising confidentiality, integrity, and availability.

HPE AOS‑CX, any installation that has not applied the latest published update, may be vulnerable. The CVE does not list specific version numbers, so organizations should assume all releases of AOS‑CX are at risk until the vendor issues a patch.

The CVSS score of 7.1 signals a high‑severity risk, while the EPSS score of less than 1 % indicates a low current probability of exploitation. The vulnerability is not yet in the CISA KEV catalog. The attack vector is likely an adjacent host that can reach the management interface over the network; no authentication is needed to trigger the flaw.