AOS‑10’s Wi‑Fi frame processing contains a flaw that allows an unauthenticated adjacent attacker to read sensitive information without authorization. The vulnerability is designated as CWE‑200 and leads to unauthorized disclosure of data that could enable the attacker to gain further network access or to disrupt normal operation of services supported by AOS‑10. While it does not provide direct execution privileges, the exposure of confidential information poses a significant confidentiality risk.

All Hewlett Packard Enterprise ArubaOS (AOS) devices running the AOS‑10 Wi‑Fi frame processing component are affected; version details are not provided, so any AOS‑10 implementation should be considered vulnerable until an official fix is applied.

With a CVSS score of 9.3 this flaw is marked critical, but the EPSS score of < 1 % indicates a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending malformed or malicious Wi‑Fi frames from any location within radio range of the device’s wireless interface, leveraging the lack of authentication to gain access; this inference is based on the description that the attacker must be adjacent and that the flaw resides in Wi‑Fi frame processing.