An unauthenticated SQL injection flaw exists in the AOS Web‑Based Management Interface that allows an attacker to inject arbitrary SQL commands, which can lead to execution of arbitrary code on the underlying system. The vulnerability exposes the system to complete loss of confidentiality, integrity, and availability; an attacker who succeeds could compromise the entire managed device, potentially pivot to other network assets. The weakness is a classic SQL injection issue, cataloged as CWE‑89.

The affected vendor is Hewlett Packard Enterprise, specifically its AOS product suite. The vulnerability is reported against an unspecified product within that line; administrators should examine any HPE AOS installations where the web‑based management interface is exposed to the network.

The CVSS score of 9.8 places this flaw in the critical range and indicates a high exploitation potential. The EPSS score is not available, however the lack of a KEV listing does not reduce the inherent severity or likelihood of exploitation. The attack vector is inferred to be network via the web interface, requiring no authentication; any machine able to reach the AOS web console could attempt malicious queries. If the interface is exposed to untrusted networks, the risk is substantially elevated.