EUVD-2026-89342
GHSA-ghw5-8j5x-rfpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network access to AP
-
DeliverySend crafted overflow packet to interface
-
ExploitCorrupt memory buffer
-
ExecutionExecute arbitrary OS commands
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be on the adjacent network of the affected 'interface' of an HPE Networking Instant ON access point - i.e., within the same Layer-2 / wireless broadcast domain (AV:A), such as an associated Wi-Fi client or a host on the local LAN - not a remote Internet-based attacker. No authentication (PR:N) and no user interaction (UI:N) are needed, and default configurations of Instant On APs running firmware ≤3.4.1.0 are affected. The primary limiting factor is the adjacency requirement, which confines realistic attackers to those with physical proximity or an existing foothold on the local network; there is no indication a non-default feature must be enabled. |
| Impact | This is a genuinely high-priority vulnerability, not a CVSS-inflated one. The CVSS 3.1 base score of 9.6 is driven by an adjacent-network attack vector (AV:A), low complexity (AC:L), no privileges or user interaction (PR:N/UI:N), a scope change (S:C), and full C:H/I:H/A:H impact - consistent with unauthenticated remote code execution on the device's underlying OS, as the vendor description states. The one factor that meaningfully tempers real-world risk is AV:A: the attacker must be on the same adjacent network segment (e.g., associated with or in Wi-Fi/LAN range of the access point), not on the open Internet, which narrows mass-exploitation potential compared to an AV:N flaw. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - the description ('unauthenticated adjacent attacker to achieve remote code execution') aligns cleanly with the CVSS vector - so there is no conflict to flag, but note that CWE is listed as N/A despite the description clearly indicating a memory-corruption buffer overflow (functionally CWE-120/CWE-787). |
| Exploit ScenarioDerived | An attacker within adjacent network range of an HPE Networking Instant ON access point (for example, connected to the same wireless SSID or local L2 segment) sends crafted traffic to the vulnerable interface, triggering a buffer overflow. With no authentication or user interaction required, this yields arbitrary command execution on the device's underlying operating system, giving the attacker full control of the access point. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.
RemediationAI
Patch available per vendor advisory: HPE has published a security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US, but the provided data does not state the exact fixed firmware version, so confirm the minimum non-vulnerable build in that bulletin and upgrade all Instant On APs currently running firmware at or below 3.4.1.0; because the affected range is given as ≤ 3.4.1.0, any remediation must move devices off that build rather than relying on configuration changes alone. Until the upgrade is applied, reduce exposure by restricting who can reach the AP's adjacent-network interfaces: place AP management on a dedicated management VLAN/SSID that ordinary wireless clients and user LAN segments cannot reach, and firewall management traffic so only trusted admin subnets can talk to the APs - the trade-off is that administrators lose direct management access from user VLANs and must use the management network or a jump host. Where wireless client-to-client or guest-to-internal bridging is not required, disable client-to-client communication and isolate guest SSIDs, which shrinks the pool of clients that share an adjacent broadcast domain with the AP - at the cost of breaking peer-to-peer and local discovery traffic between clients. If some APs cannot be patched immediately, isolate them onto a quarantined segment with no routing to production networks, and monitor for anomalous processes or outbound connections from AP management addresses, accepting that quarantined APs provide no production wireless service. Physical and RF access controls are only partial mitigations, since any attacker who can associate to an affected SSID or join the local LAN already satisfies the adjacency precondition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE Networking Instant On access points run an embedded firmware image in which a network-facing interface - reachable from the local Layer-2/wireless domain rather than from the public Internet - fails to bound-check input, producing a classic memory-safety buffer overflow (the exploit class flagged in the source tags; no CWE identifier was assigned in the input). Because the flaw is reachable with no credentials (PR:N) and no user interaction (UI:N) at adjacent-network access (AV:A) and low attack complexity (AC:L), an attacker who is already an associated Wi-Fi client or is on the same broadcast domain can corrupt memory in the affected process. The CVSS scope change (S:C) is significant: it indicates the vulnerable component (the exposed interface/service) is not the same as the impacted component (the underlying operating system), consistent with the reported outcome of arbitrary OS-level command execution and a full loss of confidentiality, integrity, and availability on the AP. The CPE record cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:* and ENISA EUVD-2026-89342 (affected versions ≤ 3.4.1.0) identify the Instant On product line as the sole affected family in the available data.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent unauthenticated buffer overflow needing no interaction (AV:A/AC:L/PR:N/UI:N) yields OS-level code execution beyond the vulnerable interface's scope (S:C) with full C/I/A loss.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Executive ViewAI
HPE Networking Instant On access points running firmware at or below 3.4.1.0 are affected by a critical buffer overflow that allows an attacker on the same Layer-2 or wireless broadcast domain to execute arbitrary commands on the device operating system, potentially compromising the AP and its network segment. No vendor-released patch identified at time of analysis, and default configurations are affected, so organizations using these APs for wireless or local LAN access face elevated risk of unauthorized control, data exposure, and service disruption. No public exploit identified at time of analysis, but leadership should prioritize remediation because adjacency from associated Wi-Fi clients or local hosts is often achievable in shared office, branch, or guest networks.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected HPE Networking Instant On APs on dedicated VLANs, restricting Layer-2/broadcast-domain access from wireless clients and local LAN hosts to the AP management interface, enabling wireless client isolation, disabling unnecessary services and broadcast/multicast features, and monitoring AP logs for anomalous command execution or reboot activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already h
Exploit-DB