Authenticated command‑injection vulnerabilities in the AOS‑8 interface enable an attacker with high‑privilege credentials, once authenticated remotely, to inject and execute arbitrary commands on the device’s operating system. Successful exploitation allows the attacker to run commands with the privileges of the impacted mechanism, potentially compromising the entire operating system and its data.

The flaw is present in Hewlett Packard Enterprise ArubaOS (AOS) version 8. No specific sub-model or patch version information is listed, implying that the vulnerability may affect the broader AOS-8 range.

The CVSS score of 7.2 reflects medium‑to‑high severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session; once accessed, an attacker can inject and execute commands via the affected interface, potentially leading to system compromise.