The vulnerability resides in the web interface of HPE Networking Analytics and Location Engine (ALE). An authenticated user can submit inputs that are passed directly to the underlying operating system, enabling the execution of arbitrary shell commands as the root user. Successful exploitation would grant the attacker full control over the host, allowing them to modify system configuration, exfiltrate data, or pivot to other assets without additional privileges.

The affected product is Hewlett Packard Enterprise Networking Analytics and Location Engine (ALE). No specific version information is provided in the data, so all releases are considered potentially vulnerable until a patch is applied.

The vulnerability carries a CVSS score of 7.2, which falls into the high severity range. EPSS data is not available, so the likelihood of exploitation remains unknown, but the lack of an EPSS value does not diminish the impact of a successful attack. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote authenticated, the attacker must first obtain valid credentials or compromise an existing authenticated session; the vulnerability cannot be exploited in a blind remote fashion.