EUVD-2026-89356
GHSA-9qc2-h4f2-m9c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain administrative CLI access
-
ExploitEnter crafted traversal path in CLI command
-
ExecutionWrite outside intended directory
-
ImpactCorrupt limited files / interrupt service
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to already hold administrative access to the Instant On command line interface (PR:H, explicitly stated as 'attacker with administrative access'), and access is local to the management interface rather than remotely reachable by default (AV:L). The path-traversal condition is triggered through the CLI on the affected service; high attack complexity (AC:H) implies additional non-trivial conditions must be met to succeed. Limiting factors: prior admin authentication is mandatory, the vector is local, exploitation is complex, impact is confined to modifying a limited set of files and interrupting the service (no data disclosure), and only Instant On versions ≤3.4.1.0 are affected. |
| Impact | This is a genuinely low-priority issue despite being a path traversal, and every available signal agrees on that. The provided CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L, base 3.0) is dominated by three strong limiting metrics: local attack vector (AV:L), high attack complexity (AC:H), and high privileges required (PR:H). PR:H means the attacker must already hold administrative access to the CLI, so this is a post-authentication, low-yield primitive rather than an entry point. Impact is bounded - no confidentiality loss (C:N) and only limited integrity/availability effects (I:L/A:L, described as modifying 'a limited set of files' and interrupting service). No EPSS score, no CISA KEV listing, and no public exploit code were provided; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC data supplied. There are no conflicting signals here - the CWE is listed as N/A in the input but the description and tag both clearly indicate path traversal (CWE-22). Overall this is a low-CVSS, low-real-risk defense-in-depth fix, not an urgent patch. |
| Exploit ScenarioDerived | An attacker who already possesses administrative CLI credentials for an HPE Networking Instant On device supplies a crafted path-traversal sequence to a CLI command, causing the service to write to or alter files outside the intended directory on the underlying OS. This lets them tamper with a limited set of system files and disrupt normal operation of the affected service. No public proof-of-concept exploit was identified, and the local vector plus high complexity make opportunistic abuse unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Authenticated path traversal in the HPE Networking Instant On command line interface allows an attacker who already holds administrative CLI access to steer file operations outside the intended directory, modifying a limited set of files on the underlying operating system and interrupting normal operation of the affected service. Only Instant On versions up to and including 3.4.1.0 are affected, and the vector is local (AV:L) with high attack complexity (AC:H) and high privileges required (PR:H), giving a CVSS 3.1 base score of 3.0. There is no data disclosure, no integrity or availability impact outside the limited file set and service interruption, no CISA KEV entry, and no public exploit identified at time of analysis.
RemediationAI
Apply the HPE-released fix identified in the vendor security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US; the available data confirms only that versions up to 3.4.1.0 are affected, and an explicit patched build number is not enumerated in the intelligence provided, so consult the advisory and upgrade anything at or below 3.4.1.0 to the first fixed release HPE lists. Because prior administrative CLI access is mandatory (PR:H) and the attack vector is local (AV:L), the most effective compensating control is to harden the management plane: restrict CLI administrative access to a dedicated, tightly controlled management VLAN or jump host, remove or disable unused administrative accounts, and rotate credentials for any account with CLI rights. Trade-offs apply - collapsing CLI access to a small admin group slows routine operations and blocks informal scripting by network staff, and strict management-network segmentation can complicate remote troubleshooting and out-of-band maintenance. Where feasible, log and alert on high-risk CLI commands that include path or filename arguments, since traversal attempts would appear as unusual path sequences in command audit trails; the trade-off is additional log volume and the need to tune noise from legitimate administrative file operations. Given the low CVSS score (3.0), no active exploitation in CISA KEV, and no public exploit identified, emergency network isolation or service shutdown is not warranted; instead schedule the upgrade through normal patching and keep monitoring the vendor advisory until a definitive patched version is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic path traversal class of weakness (often tracked as CWE-22 for improper limitation of a pathname to a restricted directory), though no CWE identifier was assigned by the reporting feed. The vulnerable surface is the command line interface of HPE Networking Instant On network management software, where a file-path or filename argument supplied to a CLI operation is not properly constrained before being used in filesystem operations on the device itself. Because the CLI normally runs with elevated service privileges after administrative login, an attacker who can reach the CLI can cause reads or writes to resolve outside the intended sandbox directory, reaching a limited subset of operating system files. Inputs constrain the impact heavily: the attack is local (AV:L), meaning the attacker must already be interacting with the management interface rather than reaching it over an untrusted remote path by default; complexity is high (AC:H), so additional non-trivial conditions must align for the traversal to succeed; and privileges are high (PR:H), explicitly requiring an administrator of the Instant On CLI. The scope is unchanged (S:U), confidentiality impact is none (C:N), and integrity and availability are both low (I:L/A:L), consistent with the description that only a limited set of files can be modified and service operation can be disrupted. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:* identifies HPE Instant On as the affected product family, with the EUVD record narrowing affected builds to 0.0.0.0 through 3.4.1.0.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Attacker needs existing admin CLI access (PR:H) over a local management vector (AV:L) with non-trivial conditions (AC:H); impact limited to some file modification and service disruption, no confidentiality loss.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Exploit-DB