Vulnerability · Published Jul 8, 2025 · Assigned by hpe
CVE-2025-37102Authenticated Command Injection Vulnerability In Instant On Command Line Interface
High 7.2
In plain English
A high-severity command injection in HPE Networking Instant On from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Networking Instant On | 3.2.0.0 – through 3.2.0.1 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H