EUVD-2026-89357
GHSA-qp54-2mv2-22hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain administrative API access
-
ExploitSend crafted request to vulnerable API endpoint
-
ExecutionTrigger buffer overflow
-
ImpactCrash affected service (transient DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated attacker who already holds administrative privileges on the HPE Networking Instant On instance (PR:H), reachable over the network to the affected API endpoint. Limiting factors are significant: only administrators can trigger it, the impact is confined to a temporary denial of service on the affected service, and the service recovers automatically without manual intervention, so there is no persistent outage. Affected versions are Instant On through 3.4.1.0. |
| Impact | This is a genuinely low-priority issue whose CVSS base score of 2.7 accurately reflects real-world risk. The vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) shows the only impact is a low-magnitude availability loss, and critically PR:H means the attacker must already hold administrative privileges on the device before exploitation - an actor who is already an admin has far more direct ways to disrupt the service than triggering a self-recovering buffer overflow. The description confirms the service 'recovers without manual intervention,' further limiting impact. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis. There are no conflicting signals: network attack vector (AV:N) is consistent with an API endpoint, and the low severity aligns across all sources. This is a low-CVSS, low-real-risk defect, not a priority. |
| Exploit ScenarioDerived | An attacker who has already obtained administrative credentials for an HPE Networking Instant On deployment sends a crafted request to a vulnerable API endpoint, triggering a buffer overflow that crashes the affected service. The service restarts on its own without operator action, producing only a brief, transient denial of service. No public exploit code was provided in the intelligence sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Buffer overflow in the API endpoint of HPE Networking Instant On lets an authenticated attacker who already holds administrative privileges interrupt the affected service, producing a short-lived denial of service that recovers on its own without manual intervention. Only administrators can reach the vulnerable code path (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), and there is no confidentiality or integrity impact, so the practical exposure is limited to brief, self-healing service interruptions. All Instant On versions up to and including 3.4.1.0 are reported affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), which is consistent with the low 2.7 base score.
RemediationAI
No vendor-released patch or exact fixed version is identified in the available data, and no upstream PR or commit is referenced; the HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US should be consulted directly to confirm whether a fixed Instant On firmware release above 3.4.1.0 is published, since absence of patch data here is not confirmation that no fix exists. Until a fixed build is confirmed, deploy compensating controls rather than relying on generic hardening: restrict the Instant On management/API interface to a dedicated management VLAN with strict IP allowlisting so only trusted administrator hosts can reach the endpoint (trade-off: blocks legitimate remote administration from other networks and requires firewall/VLAN changes), and disable remote or cloud-based management exposure of the API where local administration is sufficient (trade-off: loses convenience of remote management and may complicate multi-site operations). Because only PR:H administrators can trigger the overflow, enforcing least privilege and reviewing which accounts hold full admin rights materially reduces the attack surface, and since the resulting denial of service is low-impact and self-recovering, teams can treat this as a routine maintenance-window upgrade rather than an emergency action. Monitoring for repeated malformed or oversized requests to the management API can flag exploitation attempts, though any such alerting will not prevent the brief outage itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect (buffer overflow) in the API endpoint exposed by HPE Networking Instant On, the cloud-managed wireless and switching platform for small and mid-sized deployments. The vulnerability class is described only generically in the source data, and no CWE identifier was supplied, but the mechanics are typical of an out-of-bounds write or read against a fixed-size buffer that is populated from API request parameters, which corrupts adjacent memory and terminates or destabilizes the service process rather than yielding code execution. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:* is version-wildcarded, so the authoritative scope comes from the EUVD version data listing Instant On 0.0.0.0 through 3.4.1.0 as vulnerable. Because the CVSS vector specifies PR:H rather than PR:N, exploitation requires the attacker to already be authenticated with administrative rights, and the AV:N/AC:L components mean the request can be delivered remotely over the management/API interface with no special conditions once that privileged session exists; the scope is unchanged (S:U) and availability impact is low (A:L), matching a transient rather than persistent outage.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Network-reachable API endpoint (AV:N) requires existing administrative access (PR:H); impact is a low, self-recovering denial of service only (A:L), with no confidentiality or integrity effect.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Exploit-DB