CVE-2025-37164
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Description
CVE-2025-37164 is a critical remote code execution vulnerability (CVSS 10.0) in Hewlett Packard Enterprise (HPE) OneView, the infrastructure management platform used to manage servers, storage, and networking. The flaw stems from a code injection weakness that allows an unauthenticated remote attacker to execute arbitrary code on the HPE OneView appliance, with the ability to impact resources beyond the vulnerable component. This vulnerability is listed in CISA's KEV catalog with a remediation deadline of January 28, 2026, and its EPSS score of 0.86426 (99.4th percentile) places it among the most actively exploited vulnerabilities tracked. Ransomware association is currently unknown.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| hpe | oneview | <= 10.20.00 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US(Vendor Advisory)
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb(Exploit)
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94 describes vulnerabilities where software constructs code using externally-influenced input without properly neutralizing special elements that could modify the intended behavior. In the case of CVE-2025-37164, the HPE OneView appliance fails to sanitize user-supplied input before using it in code execution contexts, allowing an unauthenticated attacker to inject and execute arbitrary code. The maximum CVSS score of 10.0 and the Changed scope indicate that the injected code can affect components beyond the HPE OneView application itself, such as the underlying operating system or managed infrastructure.
Impact Analysis
The business impact of CVE-2025-37164 is the most severe possible, as reflected by its perfect CVSS score of 10.0. Confidentiality is fully compromised because the attacker can access all data managed by HPE OneView, including server credentials, iLO management passwords, storage configurations, network topologies, and firmware management keys across the entire infrastructure. Integrity is fully compromised as the attacker can modify any configuration managed through OneView, potentially reconfiguring servers, altering firmware update channels, or injecting malicious configurations into managed infrastructure. Availability is fully compromised because the attacker can disrupt or destroy the management plane for the entire data center infrastructure managed by OneView. The Changed scope in the CVSS vector is critical — it means the attacker does not just compromise OneView itself but can pivot to impact all systems that OneView manages, potentially including hundreds of servers, storage arrays, and network switches. The EPSS score of 0.86426 (99.4th percentile) indicates near-certain exploitation in the wild. A public Metasploit module is available, making exploitation accessible to a wide range of attackers. Although ransomware association is currently unknown, the ability to compromise an entire data center's management plane makes this vulnerability exceptionally dangerous for ransomware operators seeking maximum leverage.
Exploit Maturity
CVE-2025-37164 has a fully mature exploit landscape. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline of January 28, 2026, confirming active exploitation in the wild. The EPSS score of 0.86426 (99.4th percentile) is among the highest possible, reflecting near-certain exploitation probability. A public Metasploit exploit module is available, meaning that even low-skill attackers can exploit this vulnerability using widely available penetration testing tools. HPE has published vendor advisories with remediation guidance. The ransomware association is currently listed as unknown, but given the critical infrastructure management role of HPE OneView and the availability of weaponized exploit code, the risk of ransomware operators targeting this vulnerability is extremely high.
Remediation
- Upgrade HPE OneView immediately — Update to a version newer than 10.20.00 that includes the security fix. Consult the HPE security bulletin for the specific fixed version and upgrade instructions.
- Isolate HPE OneView from untrusted networks — HPE OneView management appliances should never be directly accessible from the internet. Place them behind firewalls and restrict access to only authorized management workstations and networks.
- Rotate all credentials managed by OneView — After patching, assume that all credentials stored in or managed by the compromised OneView instance may have been exposed. Rotate iLO passwords, server management credentials, storage access keys, and any other secrets managed through OneView.
- Audit managed infrastructure for unauthorized changes — Review all servers, storage arrays, and network devices managed by the affected OneView instance for unauthorized configuration changes, firmware modifications, or unexpected user accounts that could indicate prior exploitation.
- Implement network segmentation for management planes — Ensure that infrastructure management traffic is segregated from production and user traffic, limiting the blast radius if a management tool like OneView is compromised.
Technical Details
The CVSS v3.1 vector for CVE-2025-37164 is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding the maximum base score of 10.0 (Critical). Attack Vector (Network) means the vulnerability is exploitable remotely from any network-connected position. Attack Complexity (Low) indicates the exploit is reliable and straightforward. Privileges Required (None) means no authentication is needed. User Interaction (None) means no user action is required. Scope (Changed) is particularly significant — it means the attacker can break out of the HPE OneView security boundary and affect other systems, such as the underlying Linux OS, managed servers via iLO, and network infrastructure. Confidentiality, Integrity, and Availability are all High, reflecting complete compromise of the target and connected systems. The attack mechanism targets the HPE OneView web interface, where insufficiently sanitized input is passed to code execution functions on the underlying Linux operating system. The availability of a Metasploit module confirms that the exploitation path involves sending crafted HTTP requests to the OneView API that result in arbitrary command execution with the privileges of the OneView application, which typically runs with elevated system access.
Frequently Asked Questions
What is HPE OneView and why is this vulnerability so critical?
HPE OneView is a data center infrastructure management platform that manages servers, storage, and networking equipment. A vulnerability with a CVSS score of 10.0 and Changed scope means an attacker can not only compromise OneView itself but also pivot to all infrastructure it manages, potentially affecting an entire data center.
Is there a public exploit available?
Yes, a Metasploit exploit module is publicly available, making exploitation accessible to a wide range of attackers with minimal technical skill. This significantly increases the urgency of patching.
Do I need credentials to exploit this vulnerability?
No, CVE-2025-37164 requires no authentication and no user interaction. Any attacker who can reach the HPE OneView web interface over the network can exploit it, which is why network isolation of management interfaces is a critical mitigation.
What should I do after patching?
After upgrading HPE OneView, rotate all credentials stored in or managed by the appliance, audit managed infrastructure for unauthorized changes, and ensure the management interface is properly segmented from untrusted networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.