The vulnerability involves uncontrolled format string handling in the HPE Networking Instant ON APs interface. An unauthenticated remote attacker can supply crafted input that, when interpreted as a format string, causes the system to execute arbitrary commands on the host. This can lead to full remote code execution and also potentially crash the device, resulting in denial of service. The weakness aligns with input processing that fails to validate or escape format string syntax.

Affected systems are Hewlett Packard Enterprise Instant ON Access Points. The vulnerability exists in the interface layer of these APs; specific firmware or model details are not provided in the CVE record but the impact applies to all installed Instant ON APs referenced by Hewlett Packard Enterprise.

The CVSS score of 9.8 indicates critical severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified from this data; however the lack of a known KEV listing does not mitigate the risk because the vulnerability permits unauthenticated remote code execution. The attack vector would likely be over the network through the affected interface, requiring no authentication. An attacker could send a request with a malicious format string to trigger the exploit.