CVE-2025-37166
Published: 13 January 2026
Summary
CVE-2025-37166 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Hpe (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-37166 is a vulnerability in HPE Networking Instant On Access Points that causes a device to enter a non-responsive state when processing a specially crafted packet, in some cases requiring a hard reset to restore services. This issue, classified under CWE-770 (Allocation of Resources Without Limits or Throttling), enables denial-of-service attacks on affected networks and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated attacker with network access to the target access point can exploit this vulnerability by sending the specially crafted packet, triggering resource exhaustion that renders the device unresponsive and disrupts network connectivity until manually reset.
Mitigation details and patches are documented in the HPE security advisory available at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04988en_us&docLocale=en_US.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2189
Vulnerability details
A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor could leverage…
more
this vulnerability to conduct a Denial-of-Service attack on a target network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated network attackers to send a crafted packet triggering resource exhaustion (CWE-770), directly enabling Endpoint Denial of Service via Application or System Exploitation on the affected access point.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediates the specific flaw in HPE Networking Instant On Access Points exploited by specially crafted packets for DoS by applying vendor-provided patches from the security advisory.
Implements denial-of-service protections to identify, block, and respond to malicious traffic like the specially crafted packets causing resource exhaustion and device unresponsiveness.
Ensures resource availability on affected access points through allocation, monitoring, and controls to mitigate CWE-770 resource exhaustion from crafted packets.