This vulnerability affects the API endpoint of HPE Instant ON access points, permitting an authenticated attacker with high privileges to conduct SSRF attacks. Successful exploitation can lead to arbitrary command execution on the device's operating system, potentially compromising the device and network. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker who is authenticated with high privileges can exploit this SSRF vulnerability to execute arbitrary commands on the underlying operating system of the affected HPE Instant ON devices. This could lead to full compromise of the device, impacting confidentiality, integrity, and availability of the system and potentially the network it serves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HPE advisories for updates. Until a fix is available, restrict access to the API endpoint to trusted administrators only and apply network-level controls to limit exposure.