The vulnerability is an unauthenticated command‑injection flaw in ArubaOS AOS‑8’s PAPI protocol. By sending specially crafted UDP packets to the exposed PAPI service, an attacker can trigger arbitrary shell commands on the device, thereby executing code as a privileged user on the underlying operating system.

Hewlett Packard Enterprise ArubaOS AOS‑8 firmware devices that expose the PAPI service are potentially affected. This includes all Aruba access points running AOS‑8 with the PAPI protocol enabled.

The CVSS score of 9.8 places the flaw in the critical category, and although the EPSS score is less than 1%, the high severity indicates a significant potential impact if a vulnerable device is reachable. The flaw can be abused by an attacker who can reach the device over the network and send crafted UDP packets to the PAPI port; no authentication is required. Because remote code execution is possible, a successful exploit would grant full control over the operating system. The vulnerability is not yet listed in the CISA KEV catalog.