HPE Issues Firmware Fixes After Critical Flaws Discovered in Instant On Access Points

Hewlett Packard Enterprise (HPE) has rolled out a set of firmware updates for its Networking Instant On series of wireless access points after uncovering a total of 18 security weaknesses, several of which are classified as critical.

The most severe of these vulnerabilities could let an attacker with no prior authentication inject arbitrary commands that run with full operating‑system privileges on the device. In practice, this means a malicious actor could potentially seize control of the access point, manipulate network traffic, or use the compromised hardware as a foothold to infiltrate broader corporate networks.

Instant On products are marketed toward small and medium‑size enterprises that often lack dedicated IT staff, making timely patching essential. These devices are frequently deployed in retail stores, offices, and remote branches, where they serve as the primary gateway for employee devices and customer Wi‑Fi. Because they sit at the edge of a network, any breach can have outsized consequences.

The flaws were initially highlighted by the security community outlet GBHackers, which prompted HPE to launch an internal investigation and coordinate a response. While the exact discovery timeline was not disclosed, the company confirmed that the vulnerabilities were identified through a combination of external reporting and internal testing.

In a statement, HPE urged administrators to apply the newly released firmware as soon as possible and to verify that all devices are running the updated version. The company also recommended reviewing default configurations, disabling any unused services, and employing strong, unique passwords for management interfaces.

Industry analysts note that the incident underscores the growing scrutiny of Internet‑of‑Things (IoT) and networking equipment that often ship with minimal security hardening. As more organizations adopt cloud‑managed solutions, manufacturers are under pressure to provide rapid patch cycles and transparent vulnerability disclosures.

Looking ahead, HPE said it will continue to monitor its product line for additional issues and will work with security researchers to improve the resilience of its offerings. Users who have not yet upgraded are advised to schedule the update promptly to mitigate the risk of unauthenticated exploitation.