A critical vulnerability involving hard-coded credentials in HPE Networking Instant On Access Points allows unauthenticated remote attackers to bypass security controls and potentially gain full control of the device.

The device contains hard-coded login credentials, permitting an unauthenticated attacker to bypass standard device authentication mechanisms.

This vulnerability carries a CVSS score of 9.8, reflecting the ability for an attacker to gain unauthorized access to network infrastructure without credentials. Successful exploitation could lead to the complete compromise of the access point, potentially allowing attackers to intercept network traffic, pivot into internal segments, or disrupt wireless connectivity, causing significant operational downtime.

Immediate Action: Update affected HPE Networking Instant On devices to the latest firmware version as specified in the HPE vendor advisory.

Proactive Monitoring: Monitor network management logs for unauthorized login attempts or unexpected administrative access patterns.

Compensating Controls: Isolate management interfaces of network devices from the public internet or untrusted segments to limit exposure while applying patches.

Public Exploit Available: Unknown

The severity of this issue cannot be overstated; hard-coded credentials provide a direct path for attackers to gain administrative control. Administrators should verify their current firmware version immediately and apply the vendor-provided update to eliminate this backdoor.