The vulnerability is an unauthenticated command injection flaw in the PAPI protocol used by the AOS‑10 system. An attacker can send specially crafted PAPI packets that cause the underlying operating system to execute arbitrary commands, thereby gaining full control over the compromised device. The possibility of following that control to other systems is inferred from the remote code execution capability but is not explicitly stated in the description.

Hewlett Packard Enterprise AOS‑10 devices that expose the PAPI protocol. The CVE does not specify any particular firmware or feature versions; all AOS‑10 devices are potentially affected.

The CVSS score of 9.8 indicates a critical severity with full confidentiality, integrity, and availability impact. The EPSS score of 2% indicates a low probability of exploitation, but the high CVSS still signals critical risk. The issue is not yet catalogued in CISA KEV, but the EPSS does not preclude exploitation. An attacker does not need authentication to reach the vulnerable endpoint, implying that any host that can reach the PAPI interface is at risk. The attack path is a simple network request to the protocol handler, and no additional privileges are required.