This vulnerability allows an authenticated attacker with high privileges to perform a server-side request forgery (SSRF) against the API endpoint of HPE Networking Instant ON access points. The SSRF can be leveraged to issue arbitrary HTTP requests which, in turn, allow the attacker to execute commands on the underlying operating system as a privileged user. The impact is full remote code execution on the device.

Affecting HPE Networking Instant ON access points. No specific firmware or model versions were disclosed, but any APs running the vulnerable API endpoint and supporting authenticated API access are at risk.

The CVSS score of 7.2 indicates a high severity. Because the attack requires authentication with high privileges, it is not a public exploit. EPSS is not available, so the real-time probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based attacker who first authenticates to the AP and then performs SSRF to influence device commands.