title: Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface
description: Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
affected:
{
defaultStatus: affected
product: Aruba Access Points running InstantOS and ArubaOS 10
vendor: Hewlett Packard Enterprise (HPE)
versions:
status: affected, version: Aruba InstantOS 6.4.x:  6.4.4.8-4.2.4.20 and below
status: affected, version: Aruba InstantOS 6.5.x:  6.5.4.23 and below
status: affected, version: Aruba InstantOS 8.6.x:  8.6.0.19 and below
status: affected, version: Aruba InstantOS 8.10.x: 8.10.0.4 and below
status: affected, version: ArubaOS 10.3.x:         10.3.1.0 and below
status: affected, version: See reference document for further details
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL