The vulnerability is an authenticated command injection flaw in Hewlett Packard Enterprise AOS-10. Because the flaw requires valid credentials, an attacker who obtains or guesses a legitimate user account can provide specially crafted input that is passed to an operating-system shell. If successful, the attacker can run arbitrary commands with the privileges of the affected account, potentially compromising the entire device, leaking data, or disrupting availability.

Affected systems are Hewlett Packard Enterprise AOS-10 devices, as identified by the CNA. The product name is AOS-10 and no specific release or build is listed in the advisory. Therefore any installation of AOS-10 should be evaluated for this issue until an official statement or patch is released.

The CVSS score of 7.2 indicates high severity. EPSS information is not available and the vulnerability is not in the CISA KEV catalog. The attack vector is likely through any authenticated service exposed by AOS-10; entry requires valid credentials. Once authenticated, the flaw can be exploited without additional privileges, posing a significant risk to confidentiality, integrity, and availability.