Loading story…
Hewlett Packard Enterprise released security updates for HPE Networking Instant On Access Points to fix two vulnerabilities affecting firmware version 3.2.0.1 and earlier. The most severe issue, CVE-2025-37103, is a critical hard-coded credentials flaw with a CVSS score of 9.8 that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin HPESBNW04894 and urged customers to update affected systems.
HPE also patched CVE-2025-37102, a high-severity vulnerability with a CVSS score of 7.2 that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version 3.2.1.0 or later to reduce the risk of unauthorized access and command execution on exposed access points.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Hewlett Packard Enterprise released security updates for HPE Networking Instant On Access Point firmware to address two vulnerabilities affecting version 3.2.0.1 and earlier. The flaws include CVE-2025-37103, a critical hard-coded credentials issue, and CVE-2025-37102, a high-severity command injection issue; HPE recommended upgrading to firmware version 3.2.1.0 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett Packard Enterprise released security updates for multiple vulnerabilities in **HPE Aruba Networking** access points running **Instant AOS-8** and **AOS-10**, including two critical flaws that can lead to remote code execution. The most severe issues, tracked as `CVE-2024-42509` and `CVE-2024-47460`, affect the CLI service and can be exploited by an unauthenticated attacker by sending specially crafted packets to **UDP port 8211**, where the **PAPI** management protocol listens, enabling command injection and code execution on vulnerable devices. HPE also addressed four additional high-severity vulnerabilities — `CVE-2024-47461`, `CVE-2024-47462`, `CVE-2024-47463`, and `CVE-2024-47464` — that could allow a remote authenticated attacker to execute code or access sensitive information. HPE advised organizations to upgrade to fixed **AOS-10** and **Instant AOS-8** releases immediately, restrict exposure of management interfaces if patching cannot be completed at once, and replace Aruba products that have reached end of support.
Jul 24, 2026
Hewlett Packard Enterprise released bulletin **HPESBNW05135 rev.1** to remediate dozens of vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways and EdgeConnect SD-WAN Orchestrator. Five critical issues, **CVE-2026-76669** through **CVE-2026-76674**, carry CVSS scores of 9.8–9.9 and include authentication and authorization bypasses, information disclosure, and an unauthenticated buffer-overflow remote-code-execution flaw. An attacker could gain administrator or root-level access, steal third-party API credentials, execute arbitrary commands, disrupt services, and fully compromise gateway appliances or Orchestrator hosts. HPE has issued fixed ECOS and Orchestrator releases and urged customers to upgrade promptly. Organizations should isolate management interfaces, restrict access with Layer 3 firewall rules, and monitor administrative activity while updates are deployed. HPE reported no known public exploit code or active exploitation when the bulletin was published; the Canadian Centre for Cyber Security and Guyana National CIRT also advised affected administrators to review HPE’s guidance and apply the required updates.
Sep 17, 2026
Hewlett Packard Enterprise (**HPE Aruba Networking**) disclosed and patched multiple high-severity vulnerabilities affecting *Aruba Networking Instant On* access points/routers, warning that devices running software `3.3.1.0` and earlier are exposed to **information disclosure** and **denial-of-service (DoS)** conditions. The most notable issues include **CVE-2025-37165** (CVSS 7.5), which can expose VLAN and other internal network configuration details via unintended interfaces when operating in router mode, and **CVE-2025-37166** (CVSS 7.5), where specially crafted packets can drive devices into a non-responsive state that may require a hard reset to restore service. HPE also addressed kernel-level packet-processing weaknesses (**CVE-2023-52340** and **CVE-2022-48839**) tied to IPv4/IPv6 handling that can lead to memory corruption and service disruption. Separately, HPE Aruba issued an advisory for **ArubaOS AOS-8 and AOS-10** used by Mobility Conductors, Controllers, and Gateways, patching a broader set of vulnerabilities spanning authenticated command injection and web-interface flaws. The highest-impact item highlighted is **CVE-2025-37168** (CVSS 8.2), an **unauthenticated arbitrary file deletion** vulnerability in AOS-8 Mobility Conductors that can delete critical files and trigger a DoS condition; additional fixes include an authenticated web management interface stack overflow in AOS-10 (**CVE-2025-37169**) that can enable privileged code execution, plus multiple authenticated command injection and file upload/write issues across AOS-8/AOS-10.
Jun 29, 2026