Command injection vulnerabilities exist in the exposed interface of HPE ArubaOS (AOS) 8 that can be exploited by an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating system. The flaw allows execution of system commands without initial authentication, offering the attacker direct control over the operating system.

The vulnerability affects HPE ArubaOS (AOS) 8 appliances that expose the vulnerable command interface. No specific firmware or patch versions are listed, indicating that any installation of AOS 8 with the interface enabled may be susceptible.

The CVSS score is 10, indicating maximum severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation under normal conditions. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the vulnerable interface to be reachable and certain preconditions outside the attacker’s control to be met, but once those are satisfied, an unauthenticated attacker could run arbitrary commands remotely.