This vulnerability in HPE Instant ON affects versions from 0.0.0.0 up to and including 3.4.1.0. An authenticated local attacker with high privileges can exploit the flaw to retrieve sensitive information from the underlying operating system. The information disclosure could potentially facilitate further access to network services supported by the device, but only if specific external conditions are met. The CVSS 3.1 base score is 4.1, reflecting a medium severity with local attack vector, high attack complexity, and no user interaction required.

Successful exploitation results in disclosure of sensitive information from the underlying OS, which may be leveraged for further network service access. There is no direct impact on system integrity or availability. The attack requires authenticated local access with high privileges and certain external conditions, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch releases. Until an official fix is available, restrict local high-privilege access and monitor for suspicious activity consistent with information disclosure attempts.