HPE Access Points CVE-2025-37147

Exploitation requires local access to an affected HPE access point and the ability to interact with its firmware/boot update mechanism; the attacker then bypasses the hardware root-of-trust verification that normally restricts execution to vendor-signed firmware, enabling modified or custom firmware to run. Limiting factors: the CVSS vector is AV:L (no remote network exploitation path), and a hardware secure-boot bypass realistically implies hands-on/physical proximity to the device - meaning the practical prerequisite is device possession or console/local access, not a remote unauthenticated foothold despite PR:N/UI:N. Impact is confined to device integrity (running untrusted firmware); no confidentiality or availability impact is claimed.

This is a genuine but access-gated integrity flaw rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N = 7.1) shows the decisive limiter is AV:L: an adversary must already have local (and realistically physical/hands-on) access to the affected HPE access point before the secure boot bypass is reachable - it is not a remotely-triggerable network flaw despite PR:N/UI:N. The single-vector impact (I:H only, C:N/A:N) correctly reflects that the payoff is running unsigned/modified firmware - an integrity compromise of the device's root of trust - not data theft or denial of service. Real-world urgency signals are all low and mutually consistent: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified. There is no signal conflict here - the low AV:L reachability, low EPSS, and absence of KEV/POC together point to a targeted, physical-access threat model (e.g., supply-chain tampering, evil-maid, or persistent implant on a stolen/leased device) rather than opportunistic remote attack. Note one nuance to verify with HPE: CVSS assigns AV:L, but hardware root-of-trust/secure-boot bypasses often require physical possession of the device, which would be AV:P and lower the score - the exact preconditions (local software foothold vs. physical access) are not spelled out in the description.

An attacker with hands-on or local access to an affected HPE access point (e.g., a stolen, intercepted-in-shipping, or physically accessible ceiling-mounted unit) bypasses the hardware root-of-trust verification and flashes modified firmware. The tampered firmware executes as if vendor-signed, letting the attacker install a persistent implant, backdoor, or surveillance payload that survives reboots and reimaging. No public exploit code has been identified, and exploitation requires local access, so this is a targeted rather than scalable attack.