The AOS Web‑Based Management Interface permits unauthenticated remote attackers to inject arbitrary SQL statements. Successful injection leads to execution of arbitrary commands on the underlying operating system, giving full control over the device. This flaw is a classic SQL injection weakness (CWE‑89), enabling an attacker to compromise confidentiality, integrity, and availability of the managed device.

The affected vendor is Hewlett Packard Enterprise, specifically its AOS product suite. The vulnerability is reported against an unspecified product within that line; administrators should examine any HPE AOS installations where the web‑based management interface is exposed to the network.

The CVSS score of 9.8 places this flaw in the critical range, indicating a high exploitation potential. The EPSS score is less than 1%, suggesting a very low yet nonzero probability of exploitation. This flaw is not listed in the CISA KEV catalog, which does not diminish its inherent severity or risk. The attack vector is inferred to be network via the web interface, requiring no authentication; any machine able to reach the AOS web console could send malicious queries. Exposure of the interface to untrusted networks substantially elevates the risk.