CVE-2025-37166 - Unexpected shutdown in HPE Instant On Access Points after processing specific packets · CoreCVE

Back Back to CVE browser

HIGH

Unexpected shutdown in HPE Instant On Access Points after processing specific packets

Published Jan 13, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.46%

Description

A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor could leverage this vulnerability to conduct a Denial-of-Service attack on a target network.

Affected products

Vendor Hewlett Packard Enterprise (HPE) Product Instant On Default
affected
- Version
  3.0.0.0
  Status
  affected
  Constraints
  <=3.3.1.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hewlett Packard Enterprise (HPE)

affected

Version	Status	Constraints
3.0.0.0	affected	<=3.3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (1)

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04988en_us&docLocale=en_US

Link	Providers	Tags
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04988en_us&docLocale=en_US

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hpe

Published Jan 13, 2026

Updated May 10, 2026

Reserved Apr 16, 2025

Link CVE-2025-37166

CISA Vulnrichment

Updated Jan 13, 2026

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-37166

Severity n/a

Public date n/a

Links CVE-2025-37166