The vulnerability is a command injection flaw in the PAPI protocol of AOS‑10. An unauthenticated attacker who can reach the device can send specially crafted packets, leading to arbitrary code execution as a privileged OS user. This allows full compromise of the underlying operating system.

Hewlett Packard Enterprise ArubaOS (AOS) version 10 network appliances are affected. All instances of AOS‑10, regardless of specific build, should be considered vulnerable until the official patch is applied.

The flaw has a CVSS score of 8.3, indicating a high impact if exploited. An EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Because it is unauthenticated and relies on the PAPI protocol, the likely attack vector is remote network access, possibly from an adjacent subnet or host that can reach the PAPI endpoint.