AI analysis
A critical flaw in a management protocol on HPE Networking Instant On access points lets an unauthenticated attacker on an adjacent network bypass existing authentication controls. The issue requires no privileges and no user interaction, and successful exploitation can completely circumvent security restrictions. Impact can include remote code execution with elevated privileges, with high effects on confidentiality, integrity, and availability and a changed security scope (CVSS 9.6, adjacent). HPE Networking Instant On access points are affected; the provided data does not name specific models or firmware versions. There is no known public proof of concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Apply the vendor security update for HPE Networking Instant On access points as soon as HPE publishes a fixed build, and use the official advisory to confirm which models and firmware versions are covered. Until then, keep the management protocol off untrusted adjacent networks and limit which devices can reach AP management. Review access-point logs for unexpected unauthenticated management-protocol activity.
Affected
| HPE Networking Instant On access points | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.