A flaw in HPE Networking Instant ON access points’ management protocol allows an unauthenticated adjacent attacker to bypass existing authentication controls. While the description does not explicitly state that the attacker will gain full control, it is inferred that the bypass could enable the attacker to gain administrative access to the device’s management interface, potentially allowing the execution of arbitrary code with elevated privileges.

The vulnerability affects Hewlett Packard Enterprise Instant ON access points. No specific firmware or hardware model numbers are provided, and no version range is indicated, so administrators should verify whether their current APs are running unpatched firmware.

The CVSS score of 9.6 marks this flaw as critical, and the EPSS score of <1% indicates a low yet nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but environments that expose the compromised management protocol to an adjacent or locally connected attacker remain at risk. Successful exploitation could grant the attacker administrative control over the access point, providing a foothold for lateral movement or additional network attacks.