An unauthenticated user can inject adjacent commands into the AOS-8 command line interface when communicating over the PAPI protocol. The injection permits execution of arbitrary shell commands on the target system, effectively compromising both confidentiality and integrity of the environment. The vulnerability is a classic command injection flaw, allowing the attacker to run commands with the privileges of the affected service.

The flaw affects Hewlett Packard Enterprise devices that expose the AOS-8 command line interface through the PAPI protocol; the specific product model is not disclosed. All instances where the AOS-8 CLI is enabled and accessible over the network are considered at risk.

The vulnerability carries a CVSS score of 8.8, indicating high severity. No EPSS data is available, and the issue is not listed in CISA KEV, but the ability to execute commands without authentication makes it a high‑risk exposure. The likely attack vector is remote, over the network, and requires only network connectivity to the PAPI endpoint. The lack of authentication requirements means that any host on the network can exploit this flaw, making it a serious threat to affected installations.