The affected interface in AOS‑10 lacks proper input validation, allowing an unauthenticated attacker to inject malicious SQL statements. These injected commands are executed by the database layer, and through a flaw in the application’s handling of the results, the attacker can ultimately run arbitrary OS commands on the device. This is a classic CWE‑89 flaw that can lead to total compromise of confidentiality, integrity, and availability of the device and any services it hosts.

The vulnerability affects Hewlett Packard Enterprise AOS‑10. No specific version or patch information is supplied by the CNA, so any deployed instance of AOS‑10 that has not applied a vendor fix is considered potentially vulnerable and should be examined for remediation.

The CVSS base score of 9.8 denotes critical severity. EPSS data indicates a probability of exploitation of < 1%, but the flaw is known to be unauthenticated, meaning an attacker only requires network reach to the AOS‑10 service to craft an exploit. The absence of a KEV listing does not mitigate risk, as the vulnerability is detectable with standard testing techniques and can result in full host compromise if exploited.