HPE Aruba Patches High-Severity DoS and Data Leak Flaws in Instant On Devices

HPE Networking has released a critical patch for its Instant On series of access points and routers to fix a trio of high-severity vulnerabilities that could disrupt networks or expose internal configurations. The advisory notes that devices running software version 3.3.1.0 and below are vulnerable to Denial-of-Service attacks and information exposure.

The most disruptive flaw, CVE-2025-37166 (CVSS 7.5), can knock access points offline, stemming from how the devices handle specific network traffic, and according to the advisory, “a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services”. Privacy risks are linked to CVE-2025-37165, which affects router mode configuration and could expose certain network configuration details to unintended interfaces.

The update also addresses legacy issues in the OS kernel (CVE-2023-52340, CVE-2022-48839) related to IPv4/IPv6 packet processing that could enable DoS or memory corruption. HPE has released software version 3.3.2.0, and the advisory notes that Instant On devices started updating automatically during the week of December 1.