A command injection vulnerability exists in an interface of HPE Networking Instant ON. The flaw allows an authenticated remote attacker who has high privileges to execute arbitrary operating‑system commands. Successful exploitation would grant the attacker the same privileges as the account that accessed the interface, potentially compromising confidentiality, integrity, and availability of the device and the network.

This issue affects Hewlett Packard Enterprise’s Instant ON networking device. No specific firmware or software version information is available, so all firmware using the affected interface should be considered vulnerable.

The vulnerability is rated with a CVSS score of 7.2, indicating high severity. The EPSS score is 0.00907, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated session with high privileges, so the likely vector is an internal or compromised management user. If an attacker can obtain these credentials, they can gain full control of the device’s operating system.