This vulnerability is a CWE-119 buffer overflow in the AOS-8 command line interface that can be triggered without authentication. If an attacker sends a crafted command, they can run arbitrary commands on the underlying host as a privileged user. Successful exploitation leads to complete system compromise.

Affected systems are Hewlett Packard Enterprise AOS-8 devices.

The CVSS score of 8.1 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation. The lack of a KEV listing does not negate that an attacker could still achieve remote code execution when the vulnerability, a CWE-119 buffer overflow, is exploited. The flaw can be triggered from any network that can reach the AOS-8 command line interface, and because no authentication is required, an unauthenticated attacker can attempt exploitation. Although the likelihood is low, the potential impact remains high, so applying a vendor patch is still advised.