The vulnerability is a classic stack-based buffer overflow classified as CWE‑121, located in a specific administrative interface of the HPE AOS‑S Switch. An attacker who can authenticate to the system may send malformed data that overflows the local buffer, corrupting control data and causing the switch to crash or reset. The CVSS score of 6.5 reflects moderate severity, confirming that arbitrary code execution is not admitted, but the loss of service can disrupt network traffic and potentially expose other weaknesses if the crash is leveraged further. The description explicitly identifies a buffer overflow, a common path for denial-of-service in network devices.

The affected product is Hewlett Packard Enterprise’s AOS‑S Switch. No firmware version is cited in the CNA data, so any deployed AOS‑S that runs the vulnerable interface without the fix may be impacted. Because the flaw exists in the interface layer, all deployed switches that expose that interface to authenticated traffic are candidates.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of <1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog, implying no widespread known exploits. However, the requirement for authenticated access means that insiders or attackers who have compromised credentials can cause a denial-of-service by triggering the buffer overflow. The risk is compounded by the fact that most switches will still accept authenticated users, and the interface is likely exposed to management traffic.