EUVD-2026-89353
GHSA-wh55-67qx-9pcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Instant On network interface
-
DeliverySend crafted malformed request
-
ExploitTrigger memory corruption in service
-
ExecutionCrash service and leak limited memory
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the (unspecified) network-facing interface of HPE Networking Instant On devices running firmware 3.4.1.0 or earlier, and requires no authentication and no user interaction (PR:N/UI:N). The primary limiting factor is high attack complexity (AC:H): reliably triggering the memory-corruption condition depends on specific memory state or precisely crafted input, so exploitation is not a simple repeatable single request. Realistic impact is confined to service disruption (A:L) and disclosure of limited information (C:L); there is no integrity impact and no confirmed path to code execution in the vendor-assessed metrics. Network reachability to the affected management/service interface is a further practical gate. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) scores 4.8 (Medium) and describes an unauthenticated network-reachable memory-corruption flaw whose realistic impact is a denial of service (A:L) plus disclosure of some limited information (C:L), with no integrity impact. The high attack complexity (AC:H) is the key mitigating signal: successful exploitation of the memory-corruption condition is not reliably repeatable and likely requires specific timing, memory state, or crafted input tuning rather than a trivial single-shot payload. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no evidence of active exploitation or of automated/weaponized attacks; this reads as a genuine but modest-priority networking-appliance bug rather than an urgent critical. Note the description hints the memory corruption 'could allow' code-level effects but the vendor-scored impact caps at DoS plus limited info leak - the description language and the conservative A:L/C:L metrics are consistent, not contradictory. Because CWE is 'N/A' and no root-cause detail is published, the exact corruption class (the 'Buffer Overflow' tag is an inference) cannot be confirmed from the data. |
| Exploit ScenarioDerived | A remote attacker with network reachability to an internet- or LAN-exposed HPE Networking Instant On device (access point or switch management interface) sends specially crafted traffic to the vulnerable interface, triggering a memory-corruption condition that crashes or hangs the affected service and interrupts normal operation. The same malformed input may return fragments of adjacent memory, disclosing limited information. No public exploit code was identified, and the high attack complexity means the attacker likely needs multiple attempts or precise conditions to reliably trigger the fault. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.
RemediationAI
Patch availability is not specified in the provided intelligence, so the HPE Security Center advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US) should be treated as the authoritative source for the fixed firmware build and upgrade procedure; administrators running Instant On 3.4.1.0 or earlier should check that advisory and apply the vendor-released firmware as soon as it is available, and note that no exact fix version is confirmed from the data reviewed here. Because the flaw is reachable on a network-facing interface without authentication, the most effective compensating control is to prevent untrusted networks from reaching the device management/service surface: place Instant On devices and their management interfaces on a dedicated, firewalled management VLAN, block management and service ports from guest, IoT, and general-user segments, and restrict administrative access to known management hosts - the side effect is loss of convenient remote administration from user networks. Disabling or blocking any unused cloud or local management service exposure reduces attack surface but may break centralized monitoring and cloud management features. Monitor device logs and uptime for unexpected service restarts or interface failures, which may indicate exploitation attempts given the denial-of-service impact, and apply the vendor patch as soon as it is released rather than relying on segmentation alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a memory-corruption defect in HPE Networking Instant On, a cloud-managed wireless and switching platform whose devices expose a network-reachable management/service interface. The provided tags classify the issue as a buffer overflow, i.e. a memory-safety class flaw in which input handling on the exposed interface writes beyond intended bounds, corrupting adjacent memory; the CVE record does not assign a specific CWE (CWE: N/A). The affected component is identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:*, covering the product line rather than a fixed version, while the EUVD data narrows the vulnerable firmware range to Instant On 0.0.0.0 through 3.4.1.0. The CVSS vector describes an unauthenticated (PR:N), no-user-interaction (UI:N), network-reachable (AV:N) condition with unchanged scope (S:U), and the high attack complexity (AC:H) reflects the difficulty of reliably controlling the corrupted memory state to produce a deterministic outcome. Per the vendor-assessed metrics, consequences are confined to partial availability loss (A:L) and partial confidentiality loss (C:L), with integrity explicitly unaffected (I:N).
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Unauthenticated network trigger (AV:N/PR:N/UI:N) but memory-corruption reliability demands AC:H; impact limited to partial info leak (C:L) and service disruption (A:L), no integrity effect.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Exploit-DB