Hardcoded credentials in HPE Aruba Instant On Wi-Fi devices, let attackers to bypass authentication and access the web interface.
HPE disclosed hardcoded credentials in Aruba Instant On Wi-Fi devices that allow attackers to bypass login and access the web interface. The flaw tracked as CVE-2025-37103 (CVSS score of 9.8) impacts devices running firmware version 3.2.0.1 and below.
Aruba Instant On is a line of plug-and-play Wi-Fi access points are designed specifically for small and medium-sized businesses (SMBs). The product provides reliable, secure, and easy-to-manage wireless networks without the complexity or cost of enterprise systems.
“Hardcoded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication.” reads the advisory. “Successful exploitation could allow a remote attacker to gain administrative access to the system.”
Firmware version 3.2.1.0 or newer addressed the vulnerability.
The vendor also addressed an authenticated command injection vulnerability, tracked as CVE-2025-37102, in Instant On Command Line Interface.
“An authenticated command injection vulnerability exists in the command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.” reads the advisory.
Researcher ZZ from Ubisectech Sirius Team reported both vulnerabilities through the company’s Bug Bounty program.
HPE Aruba Networking is not aware of public exploits or attacks in the wild exploiting the above vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, CVE-2025-37103)