HPE Instant On EUVD-2026-89343

Exploitation requires adjacent-network access (AV:A): the attacker must be within the access point's wireless range or on the same link-layer/LAN segment to reach the CLI service that processes the crafted packets. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed, and any HPE Networking Instant On AP running firmware ≤3.4.1.0 in its default configuration is affected. The primary limiting factor is physical/network proximity - this is not remotely internet-exploitable - plus the requirement that the vulnerable CLI service be reachable on that segment. Mitigation is upgrading beyond version 3.4.1.0 per the HPE advisory.

This is a genuinely high-priority vulnerability despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes an unauthenticated, no-user-interaction command injection reachable over the adjacent network (Wi-Fi/L2 segment) that yields arbitrary command execution as a privileged OS user with a scope change - effectively full device takeover. The only meaningful mitigating factor is AV:A rather than AV:N: the attacker must be on the same wireless/link-layer segment as the AP, not anywhere on the internet, which bounds mass internet-wide scanning. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT evidence of low risk, merely of no observed weaponization yet. CVSS and description are internally consistent (both point to unauthenticated adjacent command injection), so there is no signal conflict to flag. The combination of trivial complexity, no authentication, and privileged code execution on a network edge device makes this a prime target for a proximity attacker (rogue client, compromised device, or malicious actor within Wi-Fi range).

An attacker within wireless range of, or on the same LAN segment as, an HPE Networking Instant On access point sends specially crafted packets to the AP's CLI-handling service. The malformed input is passed unsanitized into a shell/command context, executing attacker-chosen commands as a privileged user and giving full control of the access point. No public exploit code was identified at the time of analysis, but the low attack complexity and lack of authentication make reliable exploitation plausible once details circulate.