Command injection vulnerabilities exist in the affected interface of AOS‑10 that allow an unauthenticated attacker to inject and execute arbitrary operating‑system commands as a privileged user. Successful exploitation would give full control over the device, enabling data exfiltration, modification, and potentially allowing lateral movement within the network.

Affected systems are Hewlett Packard Enterprise devices running the AOS‑10 operating system. Specific product versions that contain the flaw are not listed in the available data. The vulnerability is reported as unauthenticated, indicating that no credentials are required to exploit it. System owners should consider all AOS‑10 installations potentially at risk until a vendor update is released.

The CVSS score of 9.6 signals critical severity, and the vulnerability is unauthenticated; based on the description, it is inferred that the likely attack vector is network‑based, meaning any host with network visibility could attempt exploitation. The EPSS score is 1.16%, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no widely documented exploitation at this time. Nonetheless, the ease of triggering command injection and the lack of authentication make it highly exploitable under normal network conditions.