EUVD-2026-89350
GHSA-6g54-w9r4-mw9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach captive portal over network
-
ExploitSend crafted request bypassing auth check
-
ExecutionCircumvent authentication controls
-
ImpactRead limited data and make limited changes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run HPE Networking Instant On (version ≤3.4.1.0) with the captive portal feature in use and network-reachable by the attacker - captive portals are typically exposed to guest/pre-authentication network clients, so this is often the default posture for deployments using the feature. No authentication, no user interaction, and no special client privileges are needed (PR:N/UI:N). Limiting factors: impact is inherently bounded (C:L/I:L, no availability impact), the vulnerability is confined to the captive-portal component rather than the full device, and sites that do not enable captive-portal functionality are not exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 Medium) describes a genuinely low-friction attack surface: network-reachable, low complexity, no privileges, no user interaction. Those access metrics alone would normally warrant urgency, but the impact metrics deliberately cap the severity - C:L/I:L/A:N means the bypass yields only 'limited access to some data' and 'limited changes,' not full compromise, consistent with the vendor description. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or imminent exploitation - the risk is currently theoretical/opportunistic rather than confirmed. No signals conflict: the network vector matches a captive-portal component that is by design internet/LAN-facing. Net assessment: a real but bounded issue - patch-worthy for exposed Instant On deployments, but not a drop-everything emergency given the limited technical impact and absence of exploitation evidence. |
| Exploit ScenarioDerived | An unauthenticated attacker on a network segment reachable by an HPE Networking Instant On captive portal sends crafted requests that circumvent the portal's authentication logic, bypassing the login gate. Once past it, the attacker reads a limited subset of portal/session data and makes limited configuration or state changes within the affected component. No public exploit code is identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets a network-reachable, unauthenticated remote attacker circumvent the portal's authentication controls and obtain limited read access to data plus the ability to make limited changes inside that component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 Medium) confirms a low-friction attack path requiring no credentials and no user interaction, although the impact is bounded to the captive-portal component with no availability effect. No public exploit code or confirmed in-the-wild exploitation has been identified - no public exploit identified at time of analysis - and no EPSS score was supplied with the source data.
RemediationAI
The primary fix is to update HPE Networking Instant On to the fixed release identified in HPE security advisory hpesbnw05150en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US); the exact patched version number is not supplied in this dataset, so the fixed version should be confirmed against that advisory, and any release that supersedes 3.4.1.0 is the target baseline for the affected range. If immediate upgrade is not possible, the most effective compensating control is to disable the captive portal feature entirely on affected controllers - this removes the exposed attack surface completely, with the clear trade-off that guest and pre-authentication onboarding workflows will stop functioning and guests will need an alternative onboarding method (for example pre-shared keys or a temporary open SSID with MAC-limited access). Where the portal must remain in service, restrict reachability so that the portal is exposed only to the intended guest VLAN/SSID and not to management, corporate, or internet-routed segments, recognising that this reduces but does not eliminate risk because the portal is by design reachable by unauthenticated clients. Additional hardening includes segmenting guest traffic from management interfaces, monitoring portal endpoints for anomalous or unexpected session/token behaviour, and treating the portal host as a low-trust asset until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable technology is the captive portal that HPE Networking Instant On exposes to pre-authentication clients - typically guests or unmanaged devices that have not yet been granted network access. Because a captive portal inherently sits in front of authentication, its HTTP/HTTPS session handling, redirect logic, and portal-access token validation run without an authenticated session, which is exactly why the assessed vector is PR:N/UI:N and AV:N. The supplied CPE, cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:*, identifies the affected product family with a wildcard version, while the EUVD record narrows the affected range to Instant On 0.0.0.0 through 3.4.1.0 ("Instant On 0.0.0.0 ≤3.4.1.0"). No CWE identifier was provided in the source data; the described behavior - bypassing existing authentication controls to obtain limited data access and limited write capability - is consistent with the improper-authentication / missing-authentication-for-critical-function class (CWE-287/CWE-306), but that mapping is an inference from the described behaviour and is not vendor-confirmed. The flaw is confined to the captive-portal component rather than the underlying device management plane, which is why confidentiality and integrity impacts are scored Low and availability is None (C:L/I:L/A:N).
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable captive portal, no auth or interaction (AV:N/AC:L/PR:N/UI:N); bypass grants only limited data read and limited changes within one component (C:L/I:L, S:U, A:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already h
Exploit-DB