TL;DR
Hewlett Packard Enterprise warned customers to urgently patch OneView after disclosing a maximum-severity remote code execution vulnerability (CVE-2025-37164) affecting versions 5.20 through 10.20. HPE recommends upgrading to OneView 11.0 or applying an emergency hotfix; security firm Rapid7 says the flaw exposes a critical management plane endpoint.
What happened
Hewlett Packard Enterprise has disclosed a critical vulnerability in its OneView infrastructure management software that allows unauthenticated remote code execution. Tracked as CVE-2025-37164 and scored 10.0 on the CVSS scale, the bug impacts OneView releases 5.20 through 10.20. HPE credited researcher Nguyen Quoc Khanh for reporting the issue and has published an advisory urging customers to either upgrade to OneView 11.0 or apply an emergency hotfix. Separate patches are provided for the OneView virtual appliance and HPE Synergy environments. Analysis by Rapid7 indicates the defect appears to be accessible via a specific REST API endpoint exposed by the appliance; the vendor’s hotfix mitigates the risk by blocking that endpoint at the web server level. HPE has not confirmed whether the vulnerability is being actively exploited in the wild.
Why it matters
- OneView often runs deep inside enterprise networks with broad privileges over servers, firmware and storage, so compromise can give attackers wide-reaching control.
- An unauthenticated remote code execution at this management layer bypasses usual login barriers and can be more dangerous than typical edge-facing server flaws.
- A CVSS 10.0 rating signals a maximum-severity issue that organizations should address immediately to prevent large-scale infrastructure compromise.
- Patch or upgrade paths are available, but slow adoption could leave critical infrastructure exposed to opportunistic attackers, including ransomware groups.
Key facts
- Vulnerability: CVE-2025-37164, rated CVSS 10.0.
- Affected products: HPE OneView versions 5.20 through 10.20.
- Impact: Remote code execution without authentication.
- Reporter: Nguyen Quoc Khanh, per HPE advisory.
- Vendor guidance: Upgrade to OneView 11.0 or apply an emergency hotfix immediately.
- Platform-specific fixes: Separate hotfixes for the OneView virtual appliance and HPE Synergy deployments.
- Technical mitigation: Rapid7’s analysis indicates the hotfix blocks a specific REST API endpoint at the web server layer.
- Exploitation status: HPE has not said whether the flaw is being actively exploited.
What to watch next
- Whether HPE or independent researchers confirm active exploitation in the wild — HPE has not stated that yet.
- Emergence of public exploit code or proof-of-concept tooling — not confirmed in the source.
- Customer patch adoption rates and any reported post-patch bypasses — not confirmed in the source.
Quick glossary
- Remote Code Execution (RCE): A vulnerability type that allows an attacker to run arbitrary code on a target system from a remote location.
- CVSS: Common Vulnerability Scoring System, a standardized framework for rating the severity of security vulnerabilities.
- REST API: An application programming interface that uses HTTP requests to GET, PUT, POST and DELETE data, commonly used for web services.
- Management plane: The layer of infrastructure responsible for configuration, control and monitoring of hardware and software resources in a network.
Reader FAQ
Which OneView versions are affected?
OneView releases 5.20 through 10.20 are listed as vulnerable.
What should customers do now?
HPE advises upgrading to OneView 11.0 or applying the emergency hotfix; separate fixes exist for the virtual appliance and Synergy.
Is the vulnerability being actively exploited?
HPE has not said whether active exploitation is occurring.
Who reported the issue?
The advisory credits researcher Nguyen Quoc Khanh.
PATCHES 4 HPE tells customers to patch fast as OneView RCE bug scores a perfect 10 Maximum-severity vuln lets unauthenticated attackers execute code on trusted infra management platform Carly Page…
Sources
- HPE tells customers to patch fast as OneView RCE bug scores a perfect 10
- HPE OneView Flaw Rated CVSS 10.0 Allows …
- Hewlett Packard Enterprise OneView Software, Remote Code …
- Critical RCE in HPE OneView Exposes Infrastructure …
Related posts
- University of Sydney alerts 27,000 after code-repository breach exposed data
- WatchGuard warns of actively exploited critical Firebox RCE; patch now
- Tren de Aragua accused of deploying Ploutus malware in US ATMs