Major Breach: HPE Aruba Access Points Expose Hard-Coded Secrets

Executive Summary

In July 2025, a significant cybersecurity breach was reported by HPE involving its Aruba Instant On Access Points. Security researcher ZZ from Ubisectech’s Sirius Team uncovered critical vulnerabilities that exposed hard-coded admin credentials within the firmware, allowing unauthorized access to device web interfaces. The first vulnerability, CVE-2025-37103, received a CVSS score of 9.8 (Critical), enabling attackers to bypass authentication effortlessly. The second vulnerability, CVE-2025-37102, rated at 7.2 (High), allowed command injection, granting attackers the ability to execute arbitrary system commands. This breach primarily affects firmware versions 3.2.0.1 and earlier, posing a severe risk to small and medium-sized businesses relying on these access points.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• July 18, 2025: HPE disclosed vulnerabilities affecting Aruba Instant On Access Points.
• Vulnerabilities were identified by security researcher ZZ, highlighting critical issues in firmware.
• Immediate remediation actions were recommended for affected users.

Data Compromised

• Hard-coded admin credentials were embedded in firmware versions 3.2.0.1 and earlier.
• Attackers could gain full administrative access, compromising device security.
• Command injection vulnerabilities allowed execution of arbitrary commands, escalating risks.

Impact Assessment

• Small and medium-sized businesses using affected access points are at high risk.
• Potential for data breaches and unauthorized network access significantly increases.
• Reputational damage to HPE and trust concerns among users are anticipated.

Company Response

• HPE initiated an immediate response to address the vulnerabilities and inform customers.
• Patches and firmware updates were scheduled to mitigate the identified risks.
• Guidance was provided to users for securing their devices post-breach.

Security Implications

• The incident emphasizes the importance of secure coding practices in firmware development.
• Hard-coded credentials pose a persistent risk in device security, necessitating industry-wide scrutiny.
• Organizations must prioritize vulnerability management and regular security audits.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.