AI analysis
A buffer overflow in an affected interface of HPE Networking Instant On lets an unauthenticated remote attacker run arbitrary code on the underlying host. The issue is network-reachable with low attack complexity and no user interaction, and successful exploitation executes code as a privileged user on the device operating system. Confidentiality, integrity, and availability are all rated high, with a CVSS 3.1 base score of 9.8. Affected deployments are those running HPE Networking Instant On; the provided data does not name specific version ranges. No public proof of concept is known, and the CVE is not listed in CISA KEV.
What to do: Apply HPE's official security update for Networking Instant On as soon as fixed firmware for your models is published, and do not leave the affected interface reachable from untrusted networks. Until then, restrict that interface to trusted management networks, review logs for unexpected privileged activity, and confirm your build only against HPE's advisory rather than assuming a version is safe.
Affected
| Hewlett Packard Enterprise HPE Networking Instant On | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.