HPE Networking Instant On Access Points Authenticated Command Injection Vulnerability

A command injection vulnerability allowing authenticated users with elevated privileges to execute arbitrary commands on the operating system as a highly privileged user has been identified in the command line interface of HPE Networking Instant On Access Points. This vulnerability affects access points running software version 3.2.0.1 and below.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the device's operating system with elevated privileges.

Remediation

Users are advised to upgrade to HPE Networking Instant On software version 3.2.1.0 or above. Instant On devices began automatic updates the week of June 30, 2025, but manual upgrades can be initiated via the Instant On app or web portal after the release date.