HPE Aruba networking Instant On Access Points have hardcoded password vulnerability
Take action: If you have HPE Aruba Instant On Access Points, be aware that the devices have hardcoded credentials and command injection flaws - both fairly trivial to be exploited. Verify that your devices have been updated to software version 3.2.1.0 or higher. If not, trigger an update process.
Learn More
Hewlett Packard Enterprise (HPE) is reporting multiple security vulnerabilities in its Aruba Networking Instant On Access Points that could allow attackers to completely compromise these enterprise Wi-Fi devices.
Vulnerabilities summary:
- CVE-2025-37103 (CVSS score 9.8) - Hardcoded Credential Exposure allowing unauthorized access to web interface. Since the administrative credentials are embedded in the firmware itself, discovering them is trivial for knowledgeable threat actors with access to the device firmware or reverse engineering capabilities.
- CVE-2025-37102 (CVSS score 7.2) - Authenticated Command Injection vulnerability in the Command Line Interface. This vulnerability can be chained with the hardcoded credential vulnerability to create a complete attack pathway.
The vulnerabilities impact Instant On Access Points running software version 3.2.0.1 and below,
HPE has patched both vulnerabilities in software version 3.2.1.0 and above. The company initiated automatic updates during the week of June 30, 2025, requiring no action from customers for the patches to be deployed. Administrators should still check for update status and can manually trigger upgrades through the Instant On mobile application or web portal interface.
