Command injection vulnerabilities exist in the management interface of AOS‑10, allowing an authenticated remote attacker with high privileges to execute arbitrary operating‑system commands. Successful exploitation could give the attacker privileged user rights on the underlying OS, enabling full control of the device. The weakness is due to insufficient filtering of command input, identified as CWE‑77 and associated with insecure file handling functions (CWE‑676).

The vulnerability concerns Hewlett Packard Enterprise equipment running the AOS‑10 operating system. No specific product or version range is enumerated in the CVE entry, so any AOS‑10 installation that has not received the latest security update could be susceptible.

The CVSS score of 7.2 indicates a high severity impact. With an EPSS score less than 1 % the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication, the most likely entry point would be through the network‑based management interface, which is inferred from the description. An attacker who can gain high‑privilege access is able to run arbitrary commands, potentially leading to full system compromise.