Host compromise via insufficient web input validation

Command injection in Aruba AirWave Glass before 1.3.3 allows remote attackers to execute arbitrary commands through the web administrative interface. The interface insufficiently validates an undisclosed input before passing it to command execution inside a container; Aruba has not named the endpoint, parameter, or code locus. No authentication or user interaction is required, and successful exploitation compromises the underlying host operating system.