The AOS‑8 web interface contains an authentication bypass that lets an unauthenticated remote attacker execute arbitrary system commands, giving the attacker full control over the device. Successful exploitation can allow the attacker to intercept network traffic and compromise systems connected to the network, thereby threatening confidentiality, integrity, and availability of the affected appliance.

Systems running the AOS‑8 suite from Hewlett Packard Enterprise are impacted. The information available identifies the product family but does not disclose specific version numbers. Any deployment that exposes the AOS‑8 web management interface to a network, whether internal or external, is potentially vulnerable.

The CVSS base score of 8.1 classifies this as a high‑severity flaw. The EPSS score of < 1% suggests a low but nonzero likelihood that the vulnerability will be exploited. The vulnerability is not listed in the CISA KEV catalog, indicating that publicly known active exploits are not documented at this time. However, the web interface provides a direct remote attack vector; a remote attacker can reach the vulnerable services without prior authentication. The potential for remote code execution makes the risk to impacted systems significant, especially if the web interface is reachable from untrusted networks.