EUVD-2026-42075
GHSA-4mpp-rc37-5jhx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Deferring to vendor-assigned PR:L pending resolution of the description-vs-vector conflict; C:H reflects cryptographic secret exposure with no integrity or availability impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of this vulnerability could allow an unauthenticated remote threat actor to access sensitive cryptographic secrets on a vulnerable system.
AnalysisAI
Sensitive cryptographic material on HPE Networking Instant On 1830, 1930, and 1960 switches is exposed to remote network actors through an information disclosure vulnerability. Exploitation allows retrieval of cryptographic secrets such as private keys, certificates, or pre-shared credentials, which could subsequently enable man-in-the-middle attacks, traffic decryption, or device impersonation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Technical ContextAI
The affected devices are HPE's SMB-oriented managed switches - the Instant On 1830 (access-layer unmanaged/smart), 1930 (smart-managed), and 1960 (smart-managed stackable) series - identified via CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_networking_instant_on:*:*:*:*:*:*:*:*. The CPE wildcard for version indicates all firmware releases are presumed affected until a patched version is confirmed. The vulnerability results in exposure of cryptographic secrets - likely TLS private keys, management-plane certificates, SNMP community strings, or similar credentials embedded in or accessible via the device's management interface. No CWE was assigned by HPE, limiting formal root-cause classification; however, based on the CVSS vector (AV:N/C:H), the exposure path is likely an insufficiently access-controlled API endpoint or management web interface that leaks key material in responses. The absence of a CWE classification is itself a data gap worth noting.
RemediationAI
Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05038en_us&docLocale=en_US for the official patched firmware version, which is not independently confirmed from the available data. Until a firmware update is applied, restrict management-plane access to the switches by placing management interfaces on an isolated VLAN accessible only to authorized administrators, and apply ACLs or firewall rules to block external access to switch management ports (typically TCP 80/443 for web GUI and TCP 22 for SSH). If the disclosure path involves SNMP, disable SNMPv1/v2c and restrict SNMPv3 to known management hosts. Rotate any cryptographic material (certificates, keys) that may have been exposed if exploitation cannot be ruled out, as recovered keys remain valid even after patching. Disabling remote management access entirely is the most effective interim control but carries operational trade-offs for distributed or remote-managed deployments.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today