InfoSecBulletin Cybersecurity for mankind
Hewlett-Packard Enterprise (HPE) warns that Aruba Instant On Access Points have hardcoded credentials, enabling attackers to skip normal authentication and reach the web interface.
Aruba Instant On Access Points are small, easy-to-use Wi-Fi devices for small to medium businesses. They provide advanced features like guest networks and traffic segmentation, and can be managed through a cloud or mobile app.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The critical security issue, CVE-2025-37103 (CVSS score: 9.8), affects Instant On Access Points using firmware 3.2.0.1 or earlier.
“Hardcoded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication,” explained HPE in the bulletin.
“Successful exploitation could allow a remote attacker to gain administrative access to the system.”
Administrative credentials are hardcoded in the firmware, making them easy to find for those with knowledge.
Attackers can access the web interface as admins to change settings, reconfigure security, install backdoors, monitor traffic, or try to move laterally.
The vulnerability was discovered by a Ubisectech Sirius Team security researcher using the alias ZZ, who reported it directly to the vendor.
Users with vulnerable devices should upgrade to firmware version 3.2.1.0 or newer to reduce risk. HPE has not provided any workarounds, so patching is advised.
It is clarified in the bulletin that CVE-2025-37103 does not impact Instant On Switches.
On the same bulletin, HPE identifies a second vulnerability, CVE-2025-37102, which is a severe authenticated command injection issue in the CLI of Aruba Instant On access points.
This flaw can be exploited in conjunction with CVE-2025-37103 since it requires admin access. Threat actors can execute arbitrary commands through the CLI for data theft, disabling security, and maintaining access.
In this case, too, the problem is resolved by upgrading to firmware version 3.2.1.0 or later, and no workaround is available.
HPE Aruba Networking has not received any reports of exploitation of the two flaws yet, but the situation may change soon. It’s important to apply the security updates right away.
