HPE Access Points CVE-2025-37146
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to management web UI
-
ExploitSubmit crafted value in config parameter
-
ExecutionInjected input reaches OS shell (CWE-77)
-
ImpactExecute arbitrary commands on underlying OS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first authenticate to the web-based management interface with high-level (administrative) privileges, consistent with CVSS PR:H - this is the primary limiting factor and means it is not remotely exploitable by unauthenticated users against default configurations. Once authenticated, a crafted value supplied through a configuration function of the management interface is passed to the underlying OS shell (CWE-77 command injection), requiring no user interaction (UI:N) and low attack complexity (AC:L). Realistic risk is therefore bounded by how well administrative access to the management plane is restricted (network segmentation, strong credentials, limited admin exposure). |
| Impact | This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) describes network-reachable, low-complexity exploitation with full C:H/I:H/A:H impact, but critically requires PR:H - high/administrative privileges on the web-based management interface - which is why the base score lands at 7.2 (High) rather than Critical. The EPSS probability is low (0.89%, 58th percentile), indicating no significant observed exploitation activity, and the CVE is not in CISA KEV and has no public exploit code identified. These signals are consistent and reinforcing: a serious technical impact (OS command execution via CWE-77 command injection) gated behind an authentication/privilege barrier that materially reduces real-world mass-exploitation risk. The main residual risk is post-authentication privilege-to-OS escalation - an already-authenticated admin, a stolen/weak credential, or a chained auth-bypass could turn this into full device takeover. No key data conflicts were found: the description ('authenticated remote attacker') agrees with the CVSS PR:H setting. Note that SSVC fields, patch version detail, and precise affected-version data were not supplied in this input and must be confirmed against the HPE advisory. |
| Exploit ScenarioDerived | An attacker who already holds administrative credentials for the HPE networking access-point configuration web interface (via reuse, phishing, a weak/default password, or a separate auth bypass) submits a crafted value in a configuration field that is passed unsanitized to an OS shell. The command injection yields arbitrary command execution on the underlying operating system, giving full control of the appliance. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated command injection in the web-based management interface of HPE network access point configuration services allows a remote attacker holding high-level administrative privileges to execute arbitrary commands on the access point's underlying operating system, resulting in full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The PR:H requirement is the dominant limiting factor: exploitation is only possible after successful authentication to the management plane with administrative rights, so default-configuration devices are not reachable by unauthenticated users. EPSS is low at 0.89% (58th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical risk is therefore bounded by how tightly administrative access to the management interface is restricted.
RemediationAI
No patch version is specified in the available data, so treat this as "No vendor-released patch identified at time of analysis" and obtain the definitive fixed firmware build directly from the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US, applying it to every affected access point as soon as it is published. In the interim, the highest-value compensating control is to remove the management interface from untrusted reachability: place access points' administrative interfaces on a dedicated management VLAN, block management ports at the network edge for any instance where administrators do not require external access, and allow management only from a small set of trusted administrative hosts. This sharply reduces exploitability because the attack requires prior authenticated admin access, but the trade-off is loss of convenient remote management and the need for an out-of-band or jump-host path. Additionally, enforce unique, strong administrative credentials, rotate any shared or default admin passwords, and disable any unused configuration or remote-management services on the APs, accepting reduced feature availability. Because successful exploitation is a full OS command execution event, monitor AP syslog and any upstream network telemetry for unexpected shell activity or abnormal configuration changes originating from the management plane.
Affected ProductsAI
HPE network access point products exposing the affected web-based management/configuration interface are impacted; the vulnerability is reported by HPE's security alert channel and documented in the vendor advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US, which should be consulted for the authoritative list of affected models and firmware builds. The supplied intelligence does not include explicit CPE strings or a confirmed affected version range, so exact firmware thresholds cannot be stated here; administrators should map their deployed access point models and firmware revisions against the HPE advisory rather than assuming version-based immunity. Devices whose management interfaces are unreachable from untrusted networks still run vulnerable code and remain affected once an administrator authenticates from any reachable path.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command, i.e. command injection) in the web-based management interface that handles configuration of network access point services. A crafted value submitted through a configuration function is passed unsanitized into a shell context on the underlying operating system, so a value that would normally be treated as data is instead interpreted as shell syntax and executed. The CVSS vector confirms a network-reachable (AV:N), low-complexity (AC:L), no-user-interaction (UI:N) attack that yields high impact across C/I/A on a single scoped component (S:U), gated entirely by the PR:H authentication precondition. Affected firmware runs on HPE access point hardware whose management plane is typically deployed on the same network as the wireless infrastructure, which is why management-plane segmentation is the key control; no CPE identifiers or explicit firmware version ranges were supplied in the available intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management UI (AV:N) with low complexity, but requires administrative authentication (PR:H); command injection to OS yields full C:H/I:H/A:H on the same device (S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Executive ViewAI
HPE network access points using the web-based management interface are susceptible to a high-severity command injection vulnerability that, if exploited by an authenticated attacker with administrative privileges, can lead to full compromise of the device's confidentiality, integrity, and availability. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so organizations must rely on strict access controls and monitoring to mitigate risk. Leadership should ensure that administrative access to these devices is tightly restricted and that any signs of compromise are promptly investigated.
Restrict management interface access to trusted networks, enforce multi-factor authentication for administrative accounts, implement least privilege for admin roles, and monitor for suspicious command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB