A buffer overflow flaw in the PAPI protocol component of ArubaOS (AOS) allows an unauthenticated remote attacker to exploit the vulnerability without any prior authentication. Successful exploitation gives the attacker administrative privileges, enabling modification of system configurations, and access to or manipulation of confidential data, thereby compromising confidentiality and integrity.

The vendor Hewlett Packard Enterprise (HPE) provides ArubaOS (AOS). No specific version numbers are listed in the advisory, so any AOS-8 installation is potentially affected.

The CVSS score of 9.8 classifies this as critical severity. Although the EPSS score is below 1%, indicating a low probability of exploitation in the wild, the vulnerability is exploitable from any network interface that permits PAPI traffic and does not require authentication. The vulnerability is not yet catalogued in the CISA KEV database, but the combination of high severity, unrestricted remote access, and bypass of authentication controls makes it a high priority for immediate remediation.