An improperly sanitized input in the AOS-8 web interface allows an attacker to inject arbitrary commands, enabling remote code execution on the affected system. This vulnerability corresponds to the command injection weakness described by CWE‑77, and any execution of injected commands would compromise confidentiality, integrity, and availability of the device. The lack of defensive checks means that any input reaching the remote shell is executed without validation.

The vulnerability affects Hewlett Packard Enterprise users deploying the AOS‑8 network operating system. Specific product and version details are not publicly disclosed by the vendor, so any installation of AOS‑8 that has the vulnerable web interface enabled is potentially exposed. No other vendors or product variants are listed in the CNA data.

The CVSS score of 7.2 indicates a high severity that involves remote exploitation over the network. EPSS information is unavailable, so the probability of exploitation cannot be quantified, but the issue is not currently listed in the CISA KEV catalog. Likely attack scenarios involve a remote attacker submitting malicious input through the web interface, such as via HTTP requests or configuration pages. Successful exploitation would grant the attacker full system control or allow them to run arbitrary shell commands on the host.