An unauthenticated vulnerability in HPE AOS‑8 allows an attacker to inject arbitrary operating‑system commands through the PAPI protocol. The vulnerability is described as allowing an attacker to send specially crafted PAPI packets that trigger command injection, yielding remote code execution as a privileged user. This weakness enables the adversary to execute code with the privileges of the underlying operating system, potentially leading to system compromise, data theft, or disruption. The flaw is a classic command injection, indexed as CWE‑77, and poses a high risk to confidentiality, integrity, and availability of the target system. The specific details of the injection vector are inferred from the information available in the CVE entry.

The exploit targets Hewlett Packard Enterprise ArubaOS (AOS) software. Specific affected versions are not provided in the available data. Administrators should verify whether their deployed AOS‑8 instances are configured to support the PAPI protocol and whether the service is reachable from untrusted networks.

The CVSS score of 8.1 classifies this as a high‑severity vulnerability. The EPSS score is < 1%, indicating a low probability of exploitation, yet the lack of publicly known exploits does not diminish the potential for exploitation; attackers can deliver the malicious payload via the exposed PAPI endpoint without authentication. This assertion is based solely on the information available and indicates that the attack vector is straightforward for an external actor who can reach the PAPI interface. Since the vulnerability is not in the CISA KEV catalog, no publicly known exploits have been disclosed yet.