HPE Instant On EUVD-2026-89341

Exploitation requires only network reachability to the affected interface of an HPE Networking Instant ON access point running firmware ≤3.4.1.0; per CVSS PR:N/UI:N/AC:L it is unauthenticated, needs no user interaction, and works against default configurations. The primary limiting factor is network exposure of the vulnerable AP interface - deployments where that management/service interface is not reachable from an attacker-controlled segment are not exposed. The exact vulnerable interface/service is not named in the advisory description, so network segmentation/filtering of the AP interface and confirming patched firmware are the key mitigations.

This is a genuine high-priority issue, not merely a high-CVSS-but-low-real-risk finding. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the most dangerous class of network flaw: remote, unauthenticated, low-complexity, no user interaction, with full CIA impact leading to arbitrary command execution on the underlying host of HPE Networking Instant ON access points. The description confirms an uncontrolled format string reachable on an exposed AP interface, a well-understood and reliably weaponizable bug class. Signal comparison: EPSS is not provided in the input; KEV status is not listed (no evidence of confirmed active exploitation); and no public POC is referenced - so all exploitation-maturity signals are currently absent. However, absence of EPSS/KEV/POC does not lower the intrinsic risk here: the bug is vendor-confirmed (reported by HPE with an official advisory), a patch boundary is defined (≤3.4.1.0 affected), and format-string-to-RCE on unauthenticated network-facing embedded devices is historically attractive to attackers and botnets. No signals conflict with the CVSS assessment; description and vector are mutually consistent. Recommend treating as urgent for any exposed Instant ON deployment pending confirmation of the exact fixed version from the HPE advisory.

An attacker who can reach the network-facing management/service interface of an HPE Networking Instant ON access point sends a crafted request containing attacker-controlled format specifiers to the vulnerable parser, corrupting memory to either crash the process (DoS) or redirect execution to run arbitrary commands as the host process. No authentication or user interaction is required. No public exploit code is referenced at time of analysis, but format-string-to-RCE is a reliably exploitable pattern on such devices.