Host compromise via authenticated arbitrary file overwrite

Arbitrary file overwrite in ArubaOS on Aruba mobility and gateway products allows remote authenticated users to replace files through the web interface. The interface accepts attacker-controlled file content and writes it to an attacker-selected filesystem path; HPE has not disclosed the request handler, validation failure, or relationship to the published out-of-bounds-write mapping. Access to a valid management account and network reachability to the web interface are required, and successful file replacement can fully compromise the underlying host operating system.