Hewlett-Packard Enterprise (HPE) has warned that hardcoded credentials have been discovered in Aruba Instant On access points. These credentials allow bypassing standard device authentication to gain access to the web interface.
Aruba Instant On access points are compact wireless devices primarily designed for small and medium-sized businesses, offering various enterprise-level features (guest networks, traffic segmentation) with management via cloud or mobile applications.
The vulnerability, identified as CVE-2025-37103 and classified as critical (with a CVSS score of 9.8), affects Instant On access points running firmware version 3.2.0.1 and below. It is specifically noted that CVE-2025-37103 does not affect Instant On switches.
“Hardcoded credentials were discovered in HPE Networking Instant On access points, allowing anyone who knows about this to bypass the device’s standard authentication,” explains HPE in their security bulletin. “Successful exploitation allows a remote attacker to gain administrative access to the system.”
Gaining access to the web interface as an administrator, attackers can change the access point settings, reconfigure the security system, implant backdoors, and also set up covert surveillance, intercept traffic, or attempt lateral movement.
Owners of vulnerable devices are advised to update the firmware to version 3.2.1.0 or newer as soon as possible, where the vulnerability has already been addressed. HPE specialists do not report any existing workarounds for this issue, so it is recommended to install the updates.
In the same security bulletin, HPE also reported another vulnerability — CVE-2025-37102. This issue is associated with authenticated command injection in the command-line interface (CLI) and also affects Aruba Instant On access points.
The vulnerability can be combined with CVE-2025-37103, as administrative rights are required for its exploitation. This will allow attackers to inject arbitrary commands into the CLI and use them to extract data, disable protections, and establish persistence in the system.
This vulnerability was also fixed in the updated firmware version 3.2.1.0, and no alternative solutions are provided for its remediation.