An unauthenticated remote attacker can exploit the captive portal in HPE Networking Instant ON to bypass authentication controls. Once bypassed, the attacker can read limited data and perform restricted changes within the affected component, but cannot fully compromise the system.

The vulnerability affects Hewlett Packard Enterprise Instant ON devices. No specific version information is provided, so all current installations are potentially at risk.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of 0.00314 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. Attackers would likely target the device over the network, interacting with the captive portal interface to gain unauthorized access.