EUVD-2026-89346
GHSA-r22v-qj37-qcgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege admin access
-
DeliveryReach affected management interface
-
ExploitSubmit crafted input with shell metacharacters
-
ExecutionTrigger command injection
-
ImpactExecute arbitrary commands as privileged OS user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess high-privilege (administrator-level) authenticated access to the HPE Networking Instant ON management interface, per PR:H - this is not a pre-authentication flaw. The affected interface must be network-reachable by the attacker (AV:N), and affected firmware is Instant On ≤ 3.4.1.0. Limiting factors: the high-privilege authentication requirement, exposure of the management plane to the attacker's network position, and running a vulnerable firmware version below the fixed release; no user interaction is needed once those hold. |
| Impact | The CVSS 3.1 base score of 7.2 (High) reflects a network-exploitable (AV:N) command injection with low complexity (AC:L) but requiring high privileges (PR:H) and no user interaction (UI:N), yielding full C:H/I:H/A:H impact on the underlying OS. The gating factor is PR:H - the attacker must already hold high/administrative privileges on the Instant ON management interface, which sharply reduces the population of viable attackers and reframes this primarily as a privilege-to-OS-code-execution escalation rather than a pre-auth remote takeover. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so this is no public exploit identified at time of analysis. SSVC-wise: exploitation is not observed, technical impact is total, but automatability is limited by the authentication requirement. Net assessment: a genuine but bounded priority - patch on a normal cadence for exposed management planes, but it is not a mass-exploitation-grade issue given the high-privilege prerequisite. Vendor advisory (HPE hpesbnw05150en_us) confirms the affected-versions and vector; CWE is not provided by the source but the behavior is classic OS command injection (CWE-78). |
| Exploit ScenarioDerived | An attacker who has obtained high-privilege/administrator credentials to the HPE Networking Instant ON management interface (via credential theft, reuse, or a compromised admin account) submits crafted input to the affected interface field that is passed unsanitized to a shell. The injected commands execute as a privileged user on the device's underlying operating system, giving full control of the appliance. No public proof-of-concept exploit is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Upgrade HPE Networking Instant ON to a firmware release later than 3.4.1.0 as directed by the HPE advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US); the advisory is expected to list the exact fixed version, which is not specified in the provided data. Until the upgrade can be applied, reduce exposure of the management interface: place it on a dedicated management VLAN reachable only from trusted administrative networks, block Internet-facing access, and disable remote management features if they are not required - the trade-off is loss of remote administration convenience. Strengthen credential controls by rotating administrator passwords, removing unused privileged accounts, and enabling multi-factor authentication where supported, since exploitation requires prior high-privilege authentication (PR:H). Monitor management-interface logs and OS process activity for unexpected command execution as a compensating detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an OS command injection flaw (root cause class CWE-78, though no CWE was supplied) in the affected interface of HPE Networking Instant ON, the cloud-managed networking line for small businesses. The management interface accepts input that is insufficiently sanitized before being passed to a system shell, allowing an authenticated high-privileged user to inject and execute arbitrary OS commands. According to the CPE and EUVD data, the affected product is HPE Instant On (cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:*) with firmware versions up to and including 3.4.1.0. Because the attacker must already hold high privileges (PR:H per the CVSS vector), this is not a pre-authentication path; instead it represents a privilege-escalation-from-admin or post-compromise persistence vector. The network attack vector (AV:N) means the management plane must be reachable by the attacker, and the resulting C:H/I:H/A:H impact confirms that successful exploitation yields privileged OS-level control. The HPE advisory (hpesbnw05150en_us) is the authoritative source for affected builds and fixed releases.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) with low complexity (AC:L) but requires existing high-privilege admin auth (PR:H); command injection yields full OS command execution, so C:H/I:H/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Executive ViewAI
HPE Networking Instant ON access points and switches running firmware up to and including 3.4.1.0 carry a command injection flaw that lets an attacker who already holds administrator credentials on the management interface run arbitrary commands on the device's underlying operating system, giving them full control of confidentiality, integrity, and availability. Because these devices sit on the network edge and management access is often reachable from broader corporate or guest segments, a single compromised or over-privileged administrator account could hand an adversary a persistent foothold for lateral movement and traffic interception. Leadership should care because no vendor patch is currently available, leaving network segmentation, credential hygiene, and management-plane exposure as the only levers available in the near term.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate device management interfaces on a dedicated administrative VLAN with strict firewall rules and no internet exposure; limit administrative access to a small, audited group of accounts with unique strong credentials and rotation; disable unnecessary management services (HTTP, Telnet, SSH where unused) and enforce encrypted management where supported; enable centralized logging and alerting on admin logins and configuration changes; monitor vendor channels for a fixed firmware release and upgrade immediately when it ships.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already h
Exploit-DB