HPE Aruba Patches High-Severity DoS and Data Leak Flaws in Instant On Devices

HPE Networking issued a security advisory for Instant On access points and routers running software version 3.3.1.0 and earlier, addressing multiple high-severity vulnerabilities — including CVE-2025-37166 (CVSS 7.5) which can induce a non-responsive state/DoS and CVE-2025-37165 which can expose router-mode configuration details — and updated devices to firmware 3.3.2.0 (with devices beginning to auto-update the week of December 1); administrators are urged to verify firmware to ensure protection.