An authentication bypass vulnerability in the AOS-10 web-based management interface can allow an unauthenticated adjacent attacker to circumvent authentication controls and run arbitrary commands on the underlying host, provided that certain preconditions outside of the attacker’s control are met. Successful exploitation could grant the attacker full control over the operating system, enabling any action that the management service can perform. This flaw maps to CWE-269, Incorrect Authorization, and it results in remote code execution with the privileges of the underlying OS.

The affected product is the AOS-10 web-based management interface delivered by Hewlett Packard Enterprise. No specific version numbers are listed; all deployments of the AOS-10 interface are potentially vulnerable.

The CVSS score of 7.1 indicates a high overall risk, and the attack vector is network-based, stemming from the web interface. EPSS data is < 1% and the vulnerability is not listed in the CISA KEV catalog. However, successful exploitation requires preconditions that are outside the attacker’s control, so the path is not entirely straightforward. An attacker who can reach the interface over the network, without credentials, may attempt the exploit, but progress is contingent on those external conditions.