A buffer overflow in the underlying operating system of ArubaOS (AOS) allows an unauthenticated remote attacker to execute arbitrary code with privileged user rights. Successful exploitation would enable the attacker to run code on the system as a privileged user, potentially taking control of the device and any services it hosts.

The flaw affects Hewlett Packard Enterprise AOS-10 and AOS-8 products. The title indicates these specific releases, so any installation of AOS-10 or AOS-8 is potentially vulnerable.

The CVSS score of 9.4 indicates critical severity. Because the vulnerability is described as unauthenticated, an attacker could target the systems without prior credentials, likely by sending malicious traffic over the network. The EPSS score of 0.00556 indicates a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, but the high CVSS together with the lack of authentication requirements signals a significant risk of exploitation.