The vulnerability permits an attacker to obtain sensitive configuration and system information through the AOS‑10 command line interface without requiring authentication. Because the interface does not verify user credentials, any individual who can reach the CLI can see privileged data, leading to a full disclosure of secrets, system secrets, or user information. The flaw is a classic exposure of sensitive data, classified under CWE‑200.

The affected product is Hewlett Packard Enterprise AOS‑10, specifically the command line interface component. The CNA lists the product as "Unknown product", so it is unclear which subcomponents or firmware versions contain the flaw; HPE has not released version details or an official reference. Administrators should verify whether their AOS‑10 deployments expose a CLI that can be accessed without authentication.

The vulnerability carries a CVSS score of 9.6, indicating a critical impact when exploitation succeeds. While EPSS is not available, the lack of an active KEV listing suggests the exploit is not yet widely observed, but the high score warrants cautious assessment. Inferred attack vectors include local or remote access to the CLI; no authentication requirement suggests that any user who can reach the interface—whether through a console, serial connection, or network—could trigger the disclosure. Attackers with such access could immediately exfiltrate sensitive material without needing additional privileges.