An unauthenticated buffer overflow vulnerability in Hewlett Packard Enterprise AOS‑10 enables a remote attacker to execute arbitrary code on the affected device. The flaw can be triggered without prior authentication and leads to full system compromise, allowing the attacker to gain control of the device, exfiltrate data, or pivot to other systems on the network. The flaw involves a buffer overflow in the device's interface, categorized as CWE‑119, which allows the attacker to compromise confidentiality, integrity, and availability of the system.

The vulnerability affects Hewlett Packard Enterprise AOS‑10 hardware and software. Specific affected versions are not detailed in the available data, so all deployments of AOS‑10 should be investigated for the potential impact until further information becomes available.

The CVSS score of 10 indicates that the vulnerability is critical. The EPSS score of 0.00499, or about 0.5%, indicates a very low but nonzero probability of exploitation. The lack of a known exploit in KEV does not reduce the fact that an unauthenticated attacker can remotely trigger the buffer overflow to achieve code execution. The attack vector likely involves sending specially crafted packets over the network to the vulnerable interface, exploiting the buffer overflow vulnerability. Because the flaw permits arbitrary code execution, the risk to any affected system is extremely high, and the likelihood of exploitation is significant if the device remains exposed.