An unauthenticated command injection flaw exists in the command line interface of ArubaOS 10, allowing an attacker to run arbitrary privileged commands on the underlying operating system. This weakness is a classic input validation failure (CWE‑77) that can give full control over the device, compromising confidentiality, integrity and availability.

The vulnerability applies to Hewlett Packard Enterprise ArubaOS (AOS) 10 systems. All HPE devices that run AOS‑10 and expose the CLI are potentially affected; no specific version restrictions are listed in the advisory.

The CVSS v3 score of 6.8 places the flaw in the Medium category. The EPSS score is 1%, indicating a very low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires local physical access to the device and does not rely on remote network connectivity. Until a vendor patch is applied, systems remain at risk and should be treated as medium priority for remediation.