HPE Instant On EUVD-2026-89349

Attacker must be network-ADJACENT to the target (AV:A): same Layer 2 broadcast domain / VLAN as the AP, or otherwise able to reach the AP's PAPI control-plane interface (Aruba/HPE PAPI is the AP management/provisioning protocol, historically UDP/8211), not routable from the internet. No authentication (PR:N) and no user interaction (UI:N) are required, and complexity is low (AC:L). Affected: HPE Networking Instant On APs running firmware ≤3.4.1.0. The principal limiting factor is the adjacency requirement - exploitation needs an existing on-network or on-air position - which substantially narrows realistic exposure versus a routable remote flaw.

This is a moderate, credible-but-not-urgent risk. The vendor CVSS of 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) describes an unauthenticated, low-complexity authentication bypass reachable only from an ADJACENT position (AV:A) - the attacker must be on the same Layer 2 segment / broadcast domain or within RF/management reach of the AP, not the open internet. Impact is integrity-only and high (I:H: the attacker circumvents auth controls and injects unauthorized network traffic to the device), with no confidentiality (C:N) or availability (A:N) consequence claimed. There is no EPSS score, no CISA KEV listing, and no public exploit - status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent (adjacent + unauth + integrity bypass), so there is no contradiction to flag; the main tempering factor is the adjacency requirement, which converts this from an internet-wide risk into an on-network/on-air threat. CWE is 'N/A' in the input, which is a minor data gap but does not change the assessment. Net: a real issue worth patching on a normal cycle, not a drop-everything emergency, given adjacency scope, integrity-only impact, and absence of exploitation signals.

An attacker with a foothold on the same LAN/VLAN as an Instant On access point - for example a rogue device on a guest or SMB office network, or a compromised host in the broadcast domain - crafts malformed PAPI protocol messages to the AP's management interface. Because the AP fails to properly enforce authentication on these control-plane requests, the attacker circumvents the auth check and sends unauthorized network traffic to the device. No public proof-of-concept is known.