An unauthenticated buffer overflow exists in a web interface that allows an attacker to execute arbitrary code on the affected system. Based on the description, it is inferred that the attacker can trigger the overflow from any network location without authentication by sending a specially crafted request. The lack of a detailed description in the advisory limits explicit technical details, but the nature of the flaw indicates a classic out‑of‑bounds write that can compromise the host process.

The vulnerability affects ArubaOS (AOS), as referenced in the HPE support article. No version range is listed, so the impact could potentially span multiple revisions of the affected product line. In the absence of specific version information, all deployments of the related HPE web interface should be treated as vulnerable until a patch is applied.

The CVSS score of 8.1 indicates high severity, and the vulnerability is considered exploitable over the network without authentication. The likely attack vector is network-based, with the buffer overflow triggered by a specially crafted request to the web service. The EPSS score is less than 1%, so the exact current exploit probability cannot be quantified, but the nature of a buffer overflow in a web service suggests that exploitation is feasible with minimal effort. Since the vulnerability is not listed in the CISA KEV catalog at the time of this assessment, it is not confirmed as a known exploited vulnerability, yet the high severity warrants immediate attention.