HPE Networking Instant On Access Points fixes 2 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] HPE Networking Instant On Access Points fixes 2 vulnerabilities

HPE Aruba Networking fixes 2 vulnerabilities in the HPE Networking Instant On Access Points product. Devices are updated automatically to version 3.2.1.0 or higher during the week of 30 June 2025. A manual upgrade is possible via the app or the web [1].

HPE Networking Instant On Access Points - hardcoded credential exposure (CVE-2025-37103)

CVSS 9.8 (Critical)

An unauthenticated remote attacker is, due to the presence of hardcoded credentials, allowed to bypass normal authentication and obtain administrator access to the system [1].

The vulnerability is present in product:

HPE Networking Instant On Access Points; <=3.2.0.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2025-37103 at cve.org, NVD
CWE-798: Use of Hard-coded Credentials at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

HPE Networking Instant On Access Points - authenticated command injection (CVE-2025-37102)

CVSS 7.2 (High)

An authenticated remote attacker with elevated privileges is, due to a command injection vulnerability in the command line, allowed to execute arbitrary commands with high system privileges [1].

The vulnerability is present in product:

HPE Networking Instant On Access Points; <=3.2.0.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2025-37102 at cve.org, NVD
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

Report feedback

[TLP:CLEAR] HPE Networking Instant On Access Points fixes 2 vulnerabilities

HPE Networking Instant On Access Points - hardcoded credential exposure (CVE-2025-37103)

CVSS 9.8 (Critical)

HPE Networking Instant On Access Points - authenticated command injection (CVE-2025-37102)

CVSS 7.2 (High)

Links