The flaw is an unauthenticated SQL injection in Hewlett Packard Enterprise AOS‑10 that permits attackers to inject arbitrary SQL commands. The injected statements, due to inadequate sanitization and error handling by the application, can be used to execute code on the host, thereby compromising confidentiality, integrity, and availability. The CVSS score of 9.8 highlights that the vulnerability can be fully exploited without authentication and can lead to complete system takeover.

The vulnerability affects Hewlett Packard Enterprise AOS‑10. No specific version or patch information is supplied by the CNA, so any deployed instance of AOS‑10 that has not applied a vendor fix is considered potentially vulnerable and should be examined for remediation.

The CVSS base score of 9.8 denotes critical severity. Although EPSS data is not available, the flaw is known to be unauthenticated, meaning an attacker only requires network reach to the AOS‑10 service to craft an exploit. The absence of a KEV listing does not mitigate risk, as the vulnerability is detectable with standard testing techniques and can result in full host compromise if exploited.