The vulnerability enables an unauthenticated remote attacker to bypass the authentication controls of the PAPI protocol in AOS‑8. By exploiting this flaw the attacker can obtain a session without valid credentials and then make limited, unauthorized changes to certain system settings. This compromises the integrity of the configuration and potentially grants the attacker unauthorized management privileges.

The weakness affects Hewlett Packard Enterprise’s AOS‑8 product line. No specific version ranges are listed; the vulnerability is reported for the product as a whole. Administrators should confirm which AOS‑8 firmware build they are running and apply any vendor updates that address authentication enforcement.

The CVSS score of 5.3 places this issue in the medium severity range. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation. Likely, the attack requires network access to the PAPI interface and may be performed remotely; however, that is inferred from the protocol context. Until a fix or advisory is released, the risk remains moderate because the attack vector is not confirmed and no exploits have been observed.