The vulnerability is an authentication bypass in the PAPI protocol of AOS‑10, which allows an unauthenticated adjacent attacker to circumvene existing authentication controls. This flaw permits an attacker to modify system configuration without valid credentials, potentially altering network behavior, service availability, and security posture.

Systems affected include Hewlett Packard Enterprise devices that run the AOS‑10 platform. The specific product variant is not identified and version details are unavailable. All deployments that expose the PAPI protocol to external or untrusted networks are potentially vulnerable.

The CVSS base score of 6.5 indicates moderate severity, but the EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the title and typical use of the PAPI protocol, the likely attack vector is inferred to require network reachability to the PAPI interface; active network or local access may be sufficient to exploit. Once the authentication check is bypassed, an attacker can push arbitrary configuration commands without restrictions.