CVE-2025-37102

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points.

A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Networking Instant On	>= 3.2.0.0, <= 3.2.0.1

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04894en_us&docLocale=en_US

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-371039.8Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal CVE-2025-371047.1A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients CVE-2025-371059.8An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371069.8An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371079.8An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371083.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-371093.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-37119.8The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthe CVE-2025-371106.0A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function CVE-2025-371116.0A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orche CVE-2025-371126.0A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestra CVE-2025-37127.5The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthen