This vulnerability in HPE Instant ON APs is due to uncontrolled format string issues in an interface component. An unauthenticated remote attacker can exploit this flaw to execute arbitrary commands on the underlying host system, potentially causing denial-of-service or full remote code execution. The CVSS 3.1 base score is 9.8, reflecting its critical severity and ease of exploitation (network attack vector, no privileges or user interaction required). The affected versions are from 0.0.0.0 up to and including 3.4.1.0. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation allows unauthenticated remote attackers to run arbitrary commands on the host, leading to complete system compromise including denial-of-service and remote code execution. This represents a critical risk to affected HPE Instant ON devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected interface and monitor for suspicious activity related to this vulnerability.