This vulnerability allows an authenticated remote attacker who has administrative privileges on a Hewlett Packard Enterprise AOS‑CX device to inject arbitrary operating system commands through the API endpoint. The flaw results from inadequate input validation, letting attackers run any command with the device’s operating system privileges. If an attacker succeeds, they can modify system configuration, exfiltrate data, or establish persistence on the device.

The affected product is Hewlett Packard Enterprise AOS‑CX. No specific version numbers are listed in the CNA data, meaning all current releases of the platform that expose the vulnerable API endpoint are potentially impacted until a patch is applied.

The CVSS score of 7.2 signals a high‑severity vulnerability. The EPSS score of 0.00972 indicates a very low but nonzero exploitation probability, and it is not listed in the CISA KEV catalog, indicating it may not be actively exploited in the wild yet. The likely attack vector is a network‑based request to the device’s management API, which the attacker must first authenticate to with administrative credentials. Successful exploitation would give the attacker the ability to execute arbitrary commands on the underlying operating system.