The flaw is a buffer overflow that permits an attacker without authentication to send specially crafted data to the affected interface on AOS-10 or AOS-8. By overflowing a local buffer, the attacker can redirect execution to arbitrary code, gaining full privileges on the underlying operating system.

Hewlett Packard Enterprise's ArubaOS (AOS) in versions AOS-10 and AOS-8 are affected, although specific sub-versions are not disclosed. Any ArubaOS system that incorporates the vulnerable component is at risk, regardless of the operating environment.

The CVSS score of 9.6 indicates critical severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the KEV catalog. The lack of required authentication and the ability to achieve remote code execution make this a high‑risk issue that could be leveraged by a wide range of adversaries.