HPE Instant On EUVD-2026-89353

Exploitation targets the (unspecified) network-facing interface of HPE Networking Instant On devices running firmware 3.4.1.0 or earlier, and requires no authentication and no user interaction (PR:N/UI:N). The primary limiting factor is high attack complexity (AC:H): reliably triggering the memory-corruption condition depends on specific memory state or precisely crafted input, so exploitation is not a simple repeatable single request. Realistic impact is confined to service disruption (A:L) and disclosure of limited information (C:L); there is no integrity impact and no confirmed path to code execution in the vendor-assessed metrics. Network reachability to the affected management/service interface is a further practical gate.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) scores 4.8 (Medium) and describes an unauthenticated network-reachable memory-corruption flaw whose realistic impact is a denial of service (A:L) plus disclosure of some limited information (C:L), with no integrity impact. The high attack complexity (AC:H) is the key mitigating signal: successful exploitation of the memory-corruption condition is not reliably repeatable and likely requires specific timing, memory state, or crafted input tuning rather than a trivial single-shot payload. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no evidence of active exploitation or of automated/weaponized attacks; this reads as a genuine but modest-priority networking-appliance bug rather than an urgent critical. Note the description hints the memory corruption 'could allow' code-level effects but the vendor-scored impact caps at DoS plus limited info leak - the description language and the conservative A:L/C:L metrics are consistent, not contradictory. Because CWE is 'N/A' and no root-cause detail is published, the exact corruption class (the 'Buffer Overflow' tag is an inference) cannot be confirmed from the data.

A remote attacker with network reachability to an internet- or LAN-exposed HPE Networking Instant On device (access point or switch management interface) sends specially crafted traffic to the vulnerable interface, triggering a memory-corruption condition that crashes or hangs the affected service and interrupts normal operation. The same malformed input may return fragments of adjacent memory, disclosing limited information. No public exploit code was identified, and the high attack complexity means the attacker likely needs multiple attempts or precise conditions to reliably trigger the fault.