The vulnerability, described as an unauthenticated adjacent command injection in the PAPI protocol of AOS‑10, allows an attacker who can reach the device to inject and execute operating‑system commands, potentially leading to full compromise, data exfiltration, or service disruption. The primary weakness is a command injection flaw (CWE‑77) that directly violates confidentiality, integrity, and availability.

Hewlett Packard Enterprise AOS‑10 network appliances are affected. All installed instances of AOS‑10, regardless of specific version, should be considered vulnerable until a patch is applied.

The flaw scores a high CVSS of 8.3, indicating significant impact if exploited. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Because it is unauthenticated and operates over the PAPI protocol, the likely attack vector is remote network access, possibly from an adjacent subnet or compromised internal host. Any host that can reach the PAPI endpoint without authentication could potentially exploit the flaw if adequate network controls are not in place.