An unauthenticated adjacent buffer overflow exists in the PAPI protocol of HPE Networking AOS‑10, enabling an attacker to access sensitive information. By sending specially crafted packets that overflow an internal buffer, the attacker can read data stored in adjacent memory. Proper exploitation could provide content that might be leveraged to gain additional access to network services that AOS‑10 supports or to disrupt the operation of the affected service.

The affected products are Hewlett Packard Enterprise devices running the AOS‑10 operating system. The PAPI protocol component in these systems is the specific target of the buffer overflow, but the exact model or firmware version affected is not specified in the available data.

With a CVSS score of 8.3 and an EPSS score of less than 1%, the vulnerability poses a high risk even though exploitation probability is currently low. The flaw’s remote, unauthenticated nature allows attackers to reach it from any host that can communicate with the PAPI interface. If exploited, the attacker could read sensitive data and potentially use that information to gain further ingress to AOS‑10 network services or to disrupt normal service operation. The vulnerability is not listed in CISA KEV, so there is currently no evidence of widespread exploitation, but the high severity warrants immediate assessment and containment.