July 22, 2025 By Pierluigi Paganini
Hardcoded credentials in HPE Aruba Instant On Wi-Fi devices, let attackers to bypass authentication and access the web interface.
HPE disclosed hardcoded credentials in Aruba Instant On Wi-Fi devices that allow attackers to bypass login and access the web interface. The flaw tracked as CVE-2025-37103 (CVSS score of 9.8) impacts devices running firmware version 3.2.0.1 and below.
Aruba Instant On is a line of plug-and-play Wi-Fi access points are designed specifically for small and medium-sized businesses (SMBs). The product provides reliable, secure, and easy-to-manage wireless networks without the complexity or cost of enterprise systems.
“Hardcoded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication.” reads the advisory. “Successful exploitation could allow a remote attacker to gain administrative access to the system.”
Firmware version 3.2.1.0 or newer addressed the vulnerability.
