Instant On
Monthly
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) allows an unauthenticated, network-positioned attacker to circumvent network access controls and reach restricted networks without credentials or user interaction. The vendor-published CVSS 3.1 base score is 8.1 (High), but our independent assessment retains AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation is gated by preconditions outside the attacker's control - the vulnerable state is transient and cannot be forced, so success depends on catching a device in that window rather than on attacker skill. There is no indication of active exploitation (no CISA KEV listing in the supplied intelligence) and no public exploit identified at time of analysis, so the practical risk is a genuine but conditionally-gated one rather than an immediately weaponizable remote compromise.
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same adjacent network segment - within wireless range or on the same link-layer/LAN - to send specially crafted packets and execute arbitrary commands as a privileged user on the underlying operating system. Any Instant On AP running firmware up to and including 3.4.1.0 in its default configuration is affected, and the scope change (S:C) in the CVSS vector means compromise of the AP can extend into the host OS and anything it can reach. At the time of analysis no public exploit code or active exploitation telemetry has been identified, but the CVSS base of 9.6, the zero-privilege, zero-interaction attack path, and the ease of obtaining adjacent-network access make this a genuinely high-priority, patching-urgent issue rather than a theoretical one. There is no public exploit identified at time of analysis.
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.
Buffer overflow in the API endpoint of HPE Networking Instant On lets an authenticated attacker who already holds administrative privileges interrupt the affected service, producing a short-lived denial of service that recovers on its own without manual intervention. Only administrators can reach the vulnerable code path (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), and there is no confidentiality or integrity impact, so the practical exposure is limited to brief, self-healing service interruptions. All Instant On versions up to and including 3.4.1.0 are reported affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), which is consistent with the low 2.7 base score.
Authenticated path traversal in the HPE Networking Instant On command line interface allows an attacker who already holds administrative CLI access to steer file operations outside the intended directory, modifying a limited set of files on the underlying operating system and interrupting normal operation of the affected service. Only Instant On versions up to and including 3.4.1.0 are affected, and the vector is local (AV:L) with high attack complexity (AC:H) and high privileges required (PR:H), giving a CVSS 3.1 base score of 3.0. There is no data disclosure, no integrity or availability impact outside the limited file set and service interruption, no CISA KEV entry, and no public exploit identified at time of analysis.
A local buffer overflow in the underlying operating system of HPE Networking Instant On devices (all builds up to and including 3.4.1.0) allows a low-privilege authenticated local attacker to interrupt the normal operation of a single affected service. The flaw is rated CVSS 3.1 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning it is not remotely reachable, requires an existing low-privileged local foothold on the device OS, and is limited to partial availability impact on one service with no confidentiality or integrity loss; no public exploit identified at time of analysis, and no CISA KEV listing or EPSS scoring is associated with this CVE. Overall risk is low and the pre-existing authenticated local access requirement is the dominant limiting factor.
Information disclosure in the underlying operating system of HPE Networking Instant On 3.4.1.0 and earlier allows an authenticated, high-privileged local attacker to read sensitive data from the device, which could then be leveraged to reach further network services supported by the platform - but only when unspecified preconditions outside the attacker's control are satisfied. Per the CVSS vector (AV:L/AC:H/PR:H/UI:N), exploitation requires local presence on the device, pre-existing administrative privileges, and a high-complexity conjunction of runtime conditions, with no user interaction; the resulting confidentiality impact is rated High while integrity and availability are unaffected (CVSS 4.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is low because the issue is confined to post-compromise scenarios on already-privileged local access.
Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already holds an authenticated administrative session (PR:H) disrupt the device's API service, rated CVSS 3.1 4.9 with availability impact High and no confidentiality or integrity impact. The disruption is transient - the affected service restarts and resumes normal operation without manual intervention - so the practical consequence is a brief loss of management/API availability rather than a persistent outage, and the requirement for admin-level credentials sharply limits who can trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be treated as a low-priority hardening item rather than an urgent patching driver.
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already holds high-privilege local access to the affected daemon to achieve arbitrary code execution as root. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.4 Medium) shows the barriers are steep: the attacker must be local and already privileged, and exploitation is further gated by 'certain preconditions outside of the attacker's control,' consistent with a high-complexity trigger such as timing or transient system state. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets a network-reachable, unauthenticated remote attacker circumvent the portal's authentication controls and obtain limited read access to data plus the ability to make limited changes inside that component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 Medium) confirms a low-friction attack path requiring no credentials and no user interaction, although the impact is bounded to the captive-portal component with no availability effect. No public exploit code or confirmed in-the-wild exploitation has been identified - no public exploit identified at time of analysis - and no EPSS score was supplied with the source data.
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4.1.0 and earlier allows an unauthenticated attacker on the same Layer 2 segment to circumvent existing authentication controls and push unauthorized traffic to the device. The issue is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, integrity-only impact) because exploitation requires an adjacent network position rather than internet reachability, and the PAPI interface is not routable from the public internet. No public exploit code has been identified at time of analysis, the flaw is not confirmed actively exploited (not in CISA KEV), and the principal exposure limiter is the requirement for an existing on-network or on-air foothold.
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On access points allows an attacker who already holds high administrative privileges to provoke a denial-of-service condition or potentially achieve remote code execution on devices running firmware 3.4.1.0 and earlier. The flaw is scored CVSS 3.1 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting that the attacker must be authenticated with high privileges and that reliable exploitation hinges on crafting format-string input that reliably corrupts memory, which often requires memory-layout knowledge or repeated attempts. No public exploit code or confirmed active exploitation was identified at time of analysis, so the dominant risk driver is the high-privilege prerequisite - an attacker must first obtain or compromise an admin account, or chain another vulnerability to reach the vulnerable function.
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) allows an unauthenticated, network-positioned attacker to circumvent network access controls and reach restricted networks without credentials or user interaction. The vendor-published CVSS 3.1 base score is 8.1 (High), but our independent assessment retains AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation is gated by preconditions outside the attacker's control - the vulnerable state is transient and cannot be forced, so success depends on catching a device in that window rather than on attacker skill. There is no indication of active exploitation (no CISA KEV listing in the supplied intelligence) and no public exploit identified at time of analysis, so the practical risk is a genuine but conditionally-gated one rather than an immediately weaponizable remote compromise.
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same adjacent network segment - within wireless range or on the same link-layer/LAN - to send specially crafted packets and execute arbitrary commands as a privileged user on the underlying operating system. Any Instant On AP running firmware up to and including 3.4.1.0 in its default configuration is affected, and the scope change (S:C) in the CVSS vector means compromise of the AP can extend into the host OS and anything it can reach. At the time of analysis no public exploit code or active exploitation telemetry has been identified, but the CVSS base of 9.6, the zero-privilege, zero-interaction attack path, and the ease of obtaining adjacent-network access make this a genuinely high-priority, patching-urgent issue rather than a theoretical one. There is no public exploit identified at time of analysis.
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.
Buffer overflow in the API endpoint of HPE Networking Instant On lets an authenticated attacker who already holds administrative privileges interrupt the affected service, producing a short-lived denial of service that recovers on its own without manual intervention. Only administrators can reach the vulnerable code path (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), and there is no confidentiality or integrity impact, so the practical exposure is limited to brief, self-healing service interruptions. All Instant On versions up to and including 3.4.1.0 are reported affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), which is consistent with the low 2.7 base score.
Authenticated path traversal in the HPE Networking Instant On command line interface allows an attacker who already holds administrative CLI access to steer file operations outside the intended directory, modifying a limited set of files on the underlying operating system and interrupting normal operation of the affected service. Only Instant On versions up to and including 3.4.1.0 are affected, and the vector is local (AV:L) with high attack complexity (AC:H) and high privileges required (PR:H), giving a CVSS 3.1 base score of 3.0. There is no data disclosure, no integrity or availability impact outside the limited file set and service interruption, no CISA KEV entry, and no public exploit identified at time of analysis.
A local buffer overflow in the underlying operating system of HPE Networking Instant On devices (all builds up to and including 3.4.1.0) allows a low-privilege authenticated local attacker to interrupt the normal operation of a single affected service. The flaw is rated CVSS 3.1 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning it is not remotely reachable, requires an existing low-privileged local foothold on the device OS, and is limited to partial availability impact on one service with no confidentiality or integrity loss; no public exploit identified at time of analysis, and no CISA KEV listing or EPSS scoring is associated with this CVE. Overall risk is low and the pre-existing authenticated local access requirement is the dominant limiting factor.
Information disclosure in the underlying operating system of HPE Networking Instant On 3.4.1.0 and earlier allows an authenticated, high-privileged local attacker to read sensitive data from the device, which could then be leveraged to reach further network services supported by the platform - but only when unspecified preconditions outside the attacker's control are satisfied. Per the CVSS vector (AV:L/AC:H/PR:H/UI:N), exploitation requires local presence on the device, pre-existing administrative privileges, and a high-complexity conjunction of runtime conditions, with no user interaction; the resulting confidentiality impact is rated High while integrity and availability are unaffected (CVSS 4.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is low because the issue is confined to post-compromise scenarios on already-privileged local access.
Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already holds an authenticated administrative session (PR:H) disrupt the device's API service, rated CVSS 3.1 4.9 with availability impact High and no confidentiality or integrity impact. The disruption is transient - the affected service restarts and resumes normal operation without manual intervention - so the practical consequence is a brief loss of management/API availability rather than a persistent outage, and the requirement for admin-level credentials sharply limits who can trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be treated as a low-priority hardening item rather than an urgent patching driver.
Local privilege escalation in HPE Networking Instant On firmware 3.4.1.0 and earlier allows an attacker who already holds high-privilege local access to the affected daemon to achieve arbitrary code execution as root. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.4 Medium) shows the barriers are steep: the attacker must be local and already privileged, and exploitation is further gated by 'certain preconditions outside of the attacker's control,' consistent with a high-complexity trigger such as timing or transient system state. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the captive portal of HPE Networking Instant On (all versions up to and including 3.4.1.0) lets a network-reachable, unauthenticated remote attacker circumvent the portal's authentication controls and obtain limited read access to data plus the ability to make limited changes inside that component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 Medium) confirms a low-friction attack path requiring no credentials and no user interaction, although the impact is bounded to the captive-portal component with no availability effect. No public exploit code or confirmed in-the-wild exploitation has been identified - no public exploit identified at time of analysis - and no EPSS score was supplied with the source data.
Authentication bypass in the PAPI control-plane protocol of HPE Networking Instant On access points running firmware 3.4.1.0 and earlier allows an unauthenticated attacker on the same Layer 2 segment to circumvent existing authentication controls and push unauthorized traffic to the device. The issue is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, integrity-only impact) because exploitation requires an adjacent network position rather than internet reachability, and the PAPI interface is not routable from the public internet. No public exploit code has been identified at time of analysis, the flaw is not confirmed actively exploited (not in CISA KEV), and the principal exposure limiter is the requirement for an existing on-network or on-air foothold.
Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On access points allows an attacker who already holds high administrative privileges to provoke a denial-of-service condition or potentially achieve remote code execution on devices running firmware 3.4.1.0 and earlier. The flaw is scored CVSS 3.1 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting that the attacker must be authenticated with high privileges and that reliable exploitation hinges on crafting format-string input that reliably corrupts memory, which often requires memory-layout knowledge or repeated attempts. No public exploit code or confirmed active exploitation was identified at time of analysis, so the dominant risk driver is the high-privilege prerequisite - an attacker must first obtain or compromise an admin account, or chain another vulnerability to reach the vulnerable function.