An unauthenticated path traversal flaw allows an attacker to target adjacent files on the device’s file system, potentially reading or writing sensitive configuration or binaries. This can compromise the integrity and confidentiality of the system and may facilitate further escalation or arbitrary code execution. The weakness falls under input validation and path handling errors.

The vulnerability affects Hewlett Packard Enterprise devices running AOS‑8. No specific versions are listed in the CNA data, so all current and legacy AOS‑8 deployments are potentially impacted.

The CVSS score of 9.6 indicates a critical severity; because the flaw is unauthenticated, attackers need only network or local access to the vulnerable component. While an EPSS score is not available, a lack of a CISA KEV listing does not reduce the risk. The potential for widespread exploitation is high, especially if the affected services are exposed to external networks. Consequently, administrators should treat this as a top‑priority threat.