EUVD-2026-29804
GHSA-5294-p6mw-34fr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N/AC:L) but requires privileged admin authentication (PR:H); command injection yields full OS compromise, so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
AnalysisAI
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker holding high privileges to upload arbitrary files to the underlying OS, potentially escalating to remote code execution as a privileged user. Multiple 8.x and 10.x branches are affected across mobility controllers/gateways running these AOS versions. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and SSVC lists exploitation status as none, indicating no observed exploitation to date.
Technical ContextAI
The flaw resides in the HTTP(S)-based management interface of AOS, the operating system that runs HPE Aruba Networking wireless mobility controllers and gateways. The root cause class is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning user-influenced input reaching the management plane is passed into an OS command context without adequate sanitization, allowing injected shell metacharacters/commands. The specific consequence described is arbitrary file upload to the underlying OS, which serves as the primitive that escalates into privileged code execution. The single affected CPE, cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), confirms the affected component is the AOS software itself rather than a specific hardware model, so any controller/gateway platform running an affected AOS build is in scope.
RemediationAI
Consult HPE security bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US) and upgrade to a fixed AOS build above the affected ranges for your branch (for example, beyond 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, and 10.7.2.2; note 10.8.0.0 is listed affected, so verify the fixed 10.8.x build in the bulletin). Exact patched version numbers should be taken directly from the HPE advisory and not assumed. Because exploitation requires an authenticated privileged session against the web management interface, the most effective compensating control until patching is to restrict management-plane access: place the controller/gateway management interface on a dedicated management VLAN or out-of-band network, apply ACLs so only trusted administrative IPs can reach the HTTPS management interface, and enforce strong, rotated administrator credentials with MFA where supported - the trade-off is tighter operational access for administrators. Auditing admin accounts and reviewing management-interface access logs for anomalous file-upload activity is also warranted.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote att
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today