The vulnerability is an unauthenticated buffer overflow in AOS‑S that allows an adjacent attacker to read arbitrary memory contents and, if successful, crash the device. This flaw, originating from an improper bounds check, can lead to both information disclosure and a denial of service. The weakness is represented by CWE‑120 for memory buffer overflows.

Hewlett Packard Enterprise AOS‑Switch (AOS‑S). No specific version numbers were provided, so all versions of the AOS‑S platform remain potentially affected.

The CVSS score of 9.3 signals a high‑severity flaw that could compromise confidentiality, integrity, and availability. EPSS indicates the exploitation probability is under 1%, suggesting that, while technically possible, the likelihood of a real‑world exploit is low. The flaw is listed in the CISA KEV catalog as not present, implying no known active attacks. The attack vector is likely through proximity, i.e., the attacker must be adjacent to the switch or on the same local network segment to send malformed packets that trigger the overflow without authenticating.