EUVD-2026-89352
GHSA-6xgw-rfhr-8vwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin API credentials
-
DeliveryAuthenticate to Instant On API endpoint
-
ExploitSend crafted request triggering fault
-
ExecutionService crashes causing DoS
-
ImpactService auto-recovers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with administrative privileges (PR:H) on an HPE Networking Instant On device running firmware version ≤3.4.1.0, and network reach to the device's management API endpoint. The attack targets the API endpoint specifically; no user interaction is needed (UI:N). Practical risk is sharply limited by the admin-authentication prerequisite - the attacker must already be a trusted administrator - and by the fact that the affected service resumes automatically without manual intervention, making the DoS transient rather than persistent. |
| Impact | This is a genuinely low-priority issue despite being remotely reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) yields a base score of 4.9 (Medium), and its severity is driven ENTIRELY by availability impact (A:H) with no confidentiality or integrity effect. The critical mitigating factor is PR:H - exploitation requires the attacker to already hold administrative privileges on the device, meaning the actor must already be trusted/authenticated at the highest level before they can trigger the DoS. The description further notes the service 'resumes without manual intervention,' so the outage is transient and self-healing rather than a persistent crash requiring operator recovery, which understates even the A:H rating in practical terms. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are consistent (no conflicts): a network-facing but admin-gated, availability-only, auto-recovering flaw. This is a low-real-risk issue whose already-modest CVSS is further blunted by the admin-privilege prerequisite and automatic recovery. |
| Exploit ScenarioDerived | An attacker who has already obtained administrative credentials for an HPE Networking Instant On device (via credential theft, insider access, or a prior compromise) sends a crafted or malformed request to the management API endpoint. This causes the targeted service to crash or hang, interrupting network management/operation, though the service restarts automatically without manual intervention. No public exploit code was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already holds an authenticated administrative session (PR:H) disrupt the device's API service, rated CVSS 3.1 4.9 with availability impact High and no confidentiality or integrity impact. The disruption is transient - the affected service restarts and resumes normal operation without manual intervention - so the practical consequence is a brief loss of management/API availability rather than a persistent outage, and the requirement for admin-level credentials sharply limits who can trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be treated as a low-priority hardening item rather than an urgent patching driver.
RemediationAI
No vendor-released patch version is specified in the available data, so the first step is to check the HPE Security Bulletin (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US) and the Instant On firmware release notes for a build above 3.4.1.0 and upgrade all devices at or below 3.4.1.0 once a fixed image is confirmed. Until then, the most effective compensating control is to remove the management API from untrusted exposure: place the Instant On management interface on a dedicated administrative VLAN, block inbound access to the device management/API ports at the perimeter firewall, and disable any cloud or remote-management path that is not operationally required - the trade-off being loss of off-site management and simplified remote troubleshooting. Additionally, enforce least privilege on administrator accounts and rotate admin credentials, since exploitation requires authenticated administrative access; the trade-off is administrative overhead and the need to reissue credentials to legitimate operators. Note that the denial of service is transient - the API service resumes automatically without manual intervention - so a monitored restart/alerting rule on the management service is a reasonable detection and impact-limitation measure rather than a load-bearing mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the management API endpoint of HPE Networking Instant On, the cloud-managed/SMB wireless access point line from Hewlett Packard Enterprise (CPE: cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:*). The API is reachable over the network (AV:N) with low attack complexity (AC:L) and needs no user interaction (UI:N), but the CVSS vector's PR:H means the caller must already be an authenticated administrator, so this is a post-authentication robustness defect in request handling rather than a pre-auth crash bug. No CWE was assigned in the source data, so the root-cause class cannot be pinned to a specific weakness identifier; functionally it is an unhandled or resource-exhausting input path that terminates the API service process. Because the scope is unchanged (S:U) and only availability is affected (C:N/I:N/A:H), the impact is confined to the API service itself rather than lateral compromise of other components, and the automatic recovery of the service means any induced downtime is self-healing. European vulnerability tracking records this as EUVD-2026-89352 with affected versions listed as Instant On 0.0.0.0 through 3.4.1.0.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Network-reachable API but requires administrative authentication (PR:H); availability-only impact (A:H) with no confidentiality or integrity effect, and self-recovering scope-unchanged service.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which resumes without manual intervention.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Exploit-DB