The AOS Web-Based Management Interface accepts input from authenticated users with high privileges that is stored and later executed in other authenticated users’ browsers without proper escaping. An attacker who authenticates can inject malicious JavaScript that will run in the context of those users, enabling execution of arbitrary scripts, session hijacking, credential theft, or unauthorized configuration changes.

This vulnerability impacts Hewlett Packard Enterprise’s AOS Web-Based Management Interface. No specific product version information is available, and the affected product name is not detailed beyond the AOS interface reference.

The CVSS score of 5.5 indicates a medium severity. The EPSS score is very low (<1%), and the vulnerability is not listed in the CISA KEV catalog, so the overall risk remains moderate, but organizations should still proactively address the issue.