EUVD-2026-89351
GHSA-hgc7-6xmx-3grw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local high-privilege foothold on device
-
DeliveryInteract with vulnerable daemon
-
ExploitTrigger flaw when required preconditions align
-
ExecutionExecute arbitrary code as root
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold local, high-privilege access to the affected daemon on an HPE Networking Instant On device running firmware ≤3.4.1.0 (PR:H, AV:L). Exploitation is further gated by 'certain preconditions outside of the attacker's control,' consistent with AC:H - meaning the attacker cannot reliably trigger the flaw at will and likely depends on timing, race conditions, or transient system state. No user interaction is required (UI:N). These limiting factors - local access, pre-existing high privileges, and uncontrolled preconditions - sharply narrow realistic exploitation to an attacker who has already substantially compromised the device. |
| Impact | This is a genuinely lower-priority issue despite its 6.4 (Medium) CVSS score, and the vector explains why: AV:L/AC:H/PR:H means an attacker must already have local, high-privilege access to the affected daemon, then win a high-complexity race or satisfy 'certain preconditions outside of the attacker's control.' The payoff (C:H/I:H/A:H = arbitrary code execution as root) is significant, but the barriers to reach it are steep. No EPSS score is provided, there is no CISA KEV listing, and no public proof-of-concept was identified - so this is 'no public exploit identified at time of analysis.' The 'RCE' tag overstates reachability: this is a LOCAL privilege escalation to root, not remote code execution (AV:L, not AV:N). The only reference is HPE's own advisory (hpesbnw05150en_us); NVD enrichment and CWE mapping are absent (CWE: N/A). Net: a real but conditional local-root escalation that matters only to an attacker who already has a privileged foothold - not a drop-everything network-exploitable flaw. |
| Exploit ScenarioDerived | An attacker who has already gained local, high-privilege access to an HPE Networking Instant On device abuses a flaw in an affected daemon to escalate to root and run arbitrary code. Success is not guaranteed on demand - it depends on preconditions outside the attacker's control (consistent with AC:H), such as timing/race windows or transient system state. No public PoC is known, so exploitation would require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already holds high-privilege local access to the affected daemon to achieve arbitrary code execution as root. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.4 Medium) shows the barriers are steep: the attacker must be local and already privileged, and exploitation is further gated by 'certain preconditions outside of the attacker's control,' consistent with a high-complexity trigger such as timing or transient system state. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixed Instant On firmware release from HPE once published - no specific patched version number is identified in the available data, so the current affected ceiling is 3.4.1.0 and administrators should upgrade past that level following the HPE advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US) and verify the advisory's exact release notes before scheduling. Because the prerequisite for this bug is an attacker who has already obtained local high-privilege access, the highest-value compensating controls are those that prevent that foothold: restrict management-plane and shell/CLI access to a dedicated management VLAN or bastion with ACLs so that only trusted administrative hosts can reach the daemon (trade-off: cloud or off-site management becomes indirect and requires a jump host), disable remote/SaaS-style management and any local debug or support-shell features when not in use (trade-off: loss of cloud monitoring and slower vendor troubleshooting), rotate and minimize credentials that carry administrative or daemon-level rights and enforce per-admin accounts instead of shared logins (trade-off: administrative overhead), and enable logging of root-level process execution and unexpected daemon restarts so that racy exploitation attempts - which may manifest as crashes or timing anomalies - are detectable. Network-level segregation and monitoring do not remove the vulnerability itself, so firmware update remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in a daemon component of HPE Networking Instant On, the firmware platform that runs on HPE's Instant On wireless access points and switches and that is normally managed through the cloud/Instant On portal or a local management interface. The affected code path is reachable only from the local system with high privileges (PR:H, AV:L), and the high attack complexity (AC:H) combined with the vendor's note about 'preconditions outside of the attacker's control' indicates the trigger is not deterministic - plausibly a race condition or state-dependent logic/memory-safety fault in the daemon that elevates an already privileged local actor to full root. No CWE identifier was assigned in the available intelligence, so the precise root-cause class is not formally classified, but the C:H/I:H/A:H impact triad confirms complete loss of confidentiality, integrity, and availability of the device once the condition is met. Because only the firmware/application CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:* is published, the exposure is confined to the Instant On firmware itself rather than to a separate management product.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local daemon flaw requiring pre-existing high privileges (AV:L/PR:H) and uncontrolled preconditions (AC:H); yields root code execution, so full C:H/I:H/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already h
Exploit-DB