The vulnerability is a buffer overflow in a specific interface of HPE ArubaOS (AOS‑8) that allows unauthenticated attackers to execute arbitrary code with privileged rights on the underlying operating system. This flaw enables full compromise of the host, granting the attacker the same level of authority as the privileged system users. No additional impacts beyond complete system takeover are documented in the description.

The affected product is listed as a Hewlett Packard Enterprise system, specifically referencing AOS‑8. No exact product sub‑model or release version is provided; therefore, the scope remains broad across the HPE AOS‑8 family. Users should verify that their deployments run this operating system and check the HPE support site for applicable updates.

The CVSS score of 9.8 indicates critical severity, meaning the vulnerability could be exploited with high impact. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, unauthenticated; an attacker would send crafted input to the vulnerable service over the network to trigger the buffer overflow, leading to arbitrary code execution with privileged privileges.