Buffer overflow vulnerabilities exist in an underlying service of AOS‑8 that allow unauthenticated remote code execution by sending specially crafted packets to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation enables an attacker to run arbitrary code as a privileged user on the underlying operating system, giving them full control over the device and compromising its confidentiality, integrity, and availability.

Hewlett Packard Enterprise ArubaOS AOS‑8 is affected. The vendor does not provide specific version information for this vulnerability in the CNA record.

The CVSS score of 9.8 indicates a critical severity. Exploitation confidence is low, as the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, involving unauthenticated network access to a vulnerable service exposed on UDP port 8211. Because no public patch is listed, the risk remains high until the vendor issues a fix or mitigation is applied.