HPE OneView RCE Vulnerability
A critical security flaw in HPE OneView is currently at high risk of exploitation following the release of a technical analysis and Proof-of-Concept (PoC) code.
Tracking as CVE-2025-37164, this vulnerability has a CVSS score of 10.0, allowing attackers to take complete control of affected systems without a password.
The vulnerability resides in the id-pools REST API endpoint within the HPE OneView infrastructure management software.
| Feature | Detail |
|---|---|
| CVE ID | CVE-2025-37164 |
| Severity | Critical (CVSS 10.0) |
| Vendor | Hewlett Packard Enterprise (HPE) |
| Affected Product | HPE OneView (Versions < 11.0) |
According to a technical analysis by Rapid7, the flaw allows unauthenticated remote code execution (RCE).
The issue stems from the executeCommand method in the PoolController class. The code for this specific API endpoint was configured to bypass authentication checks (NO_AUTH).
Consequently, the system accepts commands in JSON bodies and passes them directly to the runtime executor.
Security researchers demonstrated that by sending a simple PUT request to /rest/id-pools/executeCommand, an attacker can inject malicious commands, such as opening a reverse shell, effectively granting them “root” or high-level access to the appliance.
According to AttackerKB, a Metasploit module has already been developed, making this vulnerability easy to weaponize. The analysis indicates a specific nuance in affected versions:
HPE has released a hotfix to address this gap. The patch updates the HTTP configuration to block access to the vulnerable API path using a RewriteRule.
Administrators are urged to apply the available hotfix immediately to prevent unauthorized access.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…