A command injection flaw exists in the command line interface of HPE Networking Instant ON access points that can be triggered by sending specially crafted packets via the PAPI protocol. An unauthenticated attacker who can reach the device on the local network may submit those packets and cause the device to execute arbitrary operating‑system commands with elevated privileges. This allows full control of the underlying firmware and the ability to tamper with network configuration, store malicious code, or disrupt service, resulting in a compromise of confidentiality, integrity, and availability.

Impact extends to all HPE Instant ON access points distributed under the Hewlett Packard Enterprise brand. No specific firmware versions were disclosed, so any deployed Instant ON devices should be assumed vulnerable until verified otherwise.

The CVSS base score is 9.6, indicating critical severity, and the EPSS score is 0.00811 (0.811%), indicating that the likelihood of exploitation is low but still non‑zero. The vulnerability is exploitable from any network segment that can communicate with the device’s PAPI interface; an attacker adjacent to the APs – for example, on the same building’s internal network – can carry out the exploitation without prior authentication or just network proximity. Given the high severity, the primary risk is an attacker taking full control of the AP’s operating system.