Sensitive information disclosure vulnerabilities exist in the management interface of ArubaOS AOS‑10. An unauthenticated remote attacker can obtain confidential system information and, if exploitation succeeds, execute arbitrary commands on the underlying operating system, leading to remote code execution. The weakness is reflected by CWE‑200, indicating improper access control.

The affected product is Hewlett Packard Enterprise ArubaOS (AOS) version AOS‑10. No specific firmware revisions are listed, so all deployments of AOS‑10 should be evaluated against the HPE support documentation to determine the exact scope.

The CVSS base score of 9.8 signals a critical threat, while the EPSS score of less than 1% suggests a low exploitation probability at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers could reach the exposed management interface from the network without credentials, as the description notes unauthenticated access. Consequently, the risk remains significant until an official patch is applied or the interface is otherwise hardened.