An authenticated remote attacker can exploit a vulnerability in the CLI command handling of the AOS‑8 web interface to inject arbitrary commands, resulting in remote code execution on the underlying operating system. This corresponds to the command injection weakness described by CWE‑77 and can compromise confidentiality, integrity, and availability of the device. The lack of proper input validation means that any malicious command submitted over the authenticated session is executed without checks.

The vulnerability affects Hewlett Packard Enterprise users deploying the AOS‑8 network operating system. Specific product and version details are not publicly disclosed by the vendor, so any installation of AOS‑8 that has the vulnerable web interface enabled is potentially exposed. No other vendors or product variants are listed in the CNA data.

The CVSS score of 7.2 indicates a high severity that involves remote exploitation over the network. EPSS information indicates a very low exploit probability (less than 1%), and the issue is not currently listed in the CISA KEV catalog. Likely attack scenarios involve an authenticated remote attacker submitting malicious input through the web interface, such as via HTTP requests or configuration pages. Successful exploitation would grant the attacker full system control or allow them to run arbitrary shell commands on the host.