The vulnerability is an unauthenticated command injection flaw in the PAPI protocol used by the AOS‑10 system. An attacker can send a crafted request that causes the underlying operating system to execute arbitrary commands, thereby gaining full control over the compromised device and potentially spreading lateral movement.

Hewlett Packard Enterprise AOS‑10 devices that expose the PAPI protocol. No specific firmware or feature versions were listed in the data; the issue applies to the product line identified as "Unknown product" in the vendor record.

The CVSS score of 9.8 indicates a critical severity with full confidentiality, integrity and availability impact. No EPSS score was provided, but the omission does not diminish the high risk level. The issue is not yet catalogued in CISA KEV, but the lack of an EPSS entry does not preclude exploitation. An attacker does not need authentication to reach the vulnerable endpoint, implying that any host that can reach the PAPI interface is at risk. The attack path is a simple network request to the protocol handler, and no additional privileges are required.