EUVD-2026-89354
GHSA-hpvp-rf4j-4wxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege local OS access
-
ExploitMeet required external preconditions
-
ExecutionRead exposed sensitive OS data
-
ImpactReuse data to reach network services
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess high-privilege (administrative) access to the underlying operating system of an HPE Networking Instant On device (PR:H), local access to that device (AV:L), and satisfaction of unspecified preconditions that are explicitly outside the attacker's control (AC:H) - for example a particular runtime state or configuration that must coincidentally be present. There is no user-interaction requirement (UI:N). These factors - local-only reach, prerequisite high privilege, and dependence on uncontrolled preconditions - substantially limit realistic exploitation to post-compromise scenarios on devices running Instant On 3.4.1.0 or earlier. |
| Impact | This is a low-real-risk issue despite a C:H confidentiality impact. The CVSS 3.1 base score is only 4.1 (Medium), driven down by a demanding exploitation profile: AV:L (local access required), AC:H (high complexity - the description explicitly notes 'certain preconditions outside of the attacker's control' must be met), and PR:H (attacker must already hold high privileges on the device's underlying OS). No EPSS score is provided, no CISA KEV listing exists, and no public exploit code was identified - so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent: a local, high-privilege, high-complexity confidentiality-only leak is a defense-in-depth/post-compromise concern, not a front-line network threat. The one notable nuance is that an attacker satisfying PR:H already has substantial control over the device, so the incremental value is the disclosed data enabling lateral movement to 'network services supported by' Instant On rather than initial access. No conflicting signals: the vector (AV:L) and the description ('authenticated local attacker') agree that this is local, not remote. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege local/administrative access to the underlying OS of an HPE Networking Instant On device reads sensitive information (e.g., credentials or configuration material) exposed by the OS, then uses it to reach or authenticate to other network services managed by the Instant On environment. Success additionally depends on uncontrolled preconditions, and no public proof-of-concept exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Information disclosure in the underlying operating system of HPE Networking Instant On 3.4.1.0 and earlier allows an authenticated, high-privileged local attacker to read sensitive data from the device, which could then be leveraged to reach further network services supported by the platform - but only when unspecified preconditions outside the attacker's control are satisfied. Per the CVSS vector (AV:L/AC:H/PR:H/UI:N), exploitation requires local presence on the device, pre-existing administrative privileges, and a high-complexity conjunction of runtime conditions, with no user interaction; the resulting confidentiality impact is rated High while integrity and availability are unaffected (CVSS 4.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is low because the issue is confined to post-compromise scenarios on already-privileged local access.
RemediationAI
Consult the HPE security advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US) and move Instant On devices off the affected 0.0.0.0-3.4.1.0 range to the fixed build it designates; the available data does not state an exact patched version number, so verify the target release against the advisory rather than assuming one, and note that appliances lacking a fixed firmware cannot be fully remediated and must be compensated for. Because exploitation requires high-privilege local access plus uncontrolled preconditions, the highest-value controls are reducing and monitoring privileged local access: remove or rename default and shared administrative accounts on the underlying OS, enforce unique credentials, disable direct shell/console access except for break-glass use, and forward device and OS authentication logs to a central SIEM so anomalous privileged reads are detectable. Where the management surface can be narrowed, block untrusted networks from reaching device management services (SSH, Telnet, HTTP/HTTPS management, SNMP) and terminate administration on a dedicated out-of-band VLAN - the trade-off is loss of convenient remote management and a hard dependency on console or jump-host access, and any reliance on SNMPv2 or Telnet should be replaced with SNMPv3 and SSH respectively. Treat the device as an untrusted foothold in any environment where a local admin compromise is plausible: segment the Instant On management plane from production data VLANs, rotate any credentials or pre-shared keys that transit or are stored on the appliance, and assume disclosed secrets could enable lateral movement to the network services Instant On supports. Disabling diagnostics/debug facilities or verbose logging reduces one likely leak path but may impair troubleshooting and should be weighed against the need for forensic visibility, and none of these measures substitute for applying the vendor fix once an exact patched version is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides not in the Instant On management application itself but in the underlying operating system that Instant On network devices are built on, as reflected by the CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):instant_on:*:*:*:*:*:*:*:* with the EUVD-flagged version range 0.0.0.0 through 3.4.1.0. No CWE identifier was assigned by the reporter, so the precise root-cause class is not documented; the observable behavior - retrieval of information usable to pivot toward other network services supported by the appliance - places it in the exposure-of-sensitive-information family (broadly CWE-200), typically arising from overly permissive file permissions, world-readable configuration or credential stores, or diagnostic/debug interfaces that leak system state. The assessed vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N is significant: AV:L means the attacker must already have a foothold on the device's OS rather than reaching it across the network, PR:H means administrative-level rights on that OS are a prerequisite, and AC:H plus the vendor's own note about preconditions outside the attacker's control indicate that a particular configuration or runtime state must coincidentally exist for the leak to occur. The High confidentiality rating therefore describes the value of the disclosed data - potentially credentials, tokens, or service parameters enabling lateral movement to other network services - rather than ease of exploitation. Because the weakness is in the host OS layer shared across the product line, remediation tracks the Instant On firmware/OS release rather than a single management component.
Know when Instant On gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Local access and prerequisite high OS privileges give AV:L/PR:H; uncontrolled preconditions justify AC:H; confidentiality-only leak means C:H, I:N, A:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Instant On
View allUnauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can r
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same a
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) al
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an aut
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated rem
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On acce
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already hold
Exploit-DB