A local privilege‑escalation flaw exists in the daemon that runs in HPE Networking Instant ON. If an attacker who already has local access exploits the flaw, they can obtain root level execution when certain environmental conditions that are not under their control are present. The vulnerability allows an adversary to bypass normal authorization checks and run arbitrary code with system privileges, thereby compromising confidentiality, integrity, and availability of the affected device.

This issue affects the Hewlett Packard Enterprise Instant ON platform. The specific daemon in the product is vulnerable, but exact version numbers are not disclosed in the supplied data. Any installation of HPE Instant ON that includes this daemon component is susceptible.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is < 1%, and the lack of entry in the CISA KEV catalog suggests that known exploits are not currently public. The exploit is local, requiring the attacker to already have some level of user access on the device. Successful execution depends on environmental preconditions beyond the attacker’s control, which slightly reduces ease of exploitation but still represents a credible risk to systems that have no additional local restrictions.