A format‑string vulnerability exists in the API endpoint of HPE Networking Instant ON networking thin‑APs. The flaw allows an authenticated remote attacker with high privileges to send a crafted payload that causes memory corruption. Successful exploitation could deliver a denial‑of‑service condition or even trigger remote code execution on the AP device.

The vulnerability affects HPE Networking Instant ON devices. No specific firmware or software version numbers are supplied; all installations with the affected API endpoint are considered potentially vulnerable.

The CVSS score of 6.6 indicates a moderate severity. The EPSS score is not reported, so the current exploitation probability is unknown. The exploit requires authentication and high privileges, limiting the threat surface, but the possibility of remote code execution elevates the risk. The CVE is not listed in the CISA KEV catalog, indicating no known public exploits at this time.