HPE Issues Urgent Patch for Critical OneView Security Flaw Allowing Unauthenticated Remote Code Execution
Hewlett Packard Enterprise (HPE) has issued an urgent advisory urging customers to patch their systems immediately after discovering a severe vulnerability in HPE OneView. The flaw, tracked as CVE-2025-37164, is rated a maximum severity score of 10.0 on the CVSS scale and could enable attackers to execute malicious code on the management platform without requiring any authentication.
Key Details of the Vulnerability
- Impact: Unauthenticated remote code execution
- Affected Versions: HPE OneView 5.20 through 10.20
- Reported by: Security researcher Nguyen Quoc Khanh
- Severity: Critical (CVSS 10.0)
What Is HPE OneView?
HPE OneView acts as a centralized management platform in many enterprise environments, overseeing servers, firmware, storage, and lifecycle management. Due to its privileged position, vulnerabilities in OneView pose a significant security threat.
The Nature of the Vulnerability
HPE confirmed that this vulnerability could be exploited remotely without any login credentials. Rapid7, a cybersecurity firm analyzing the flaw, emphasized that the real danger lies in where the vulnerability exists—deep within the network with broad privileges—making it a prime target for attackers.
Potential Consequences
An attacker exploiting this flaw could gain control over extensive parts of an organization’s infrastructure, rather than just compromising a single device. This elevates the threat level considerably, especially given OneView's typical deployment in high-security, trusted environments.
Solutions and Recommendations
HPE recommends immediate action:
- Upgrade to OneView 11.0, or
- Apply the emergency hotfix available for affected versions.
The hotfix primarily addresses the vulnerability by restricting access to the affected REST API endpoint at the web server level.
Additional Security Advice
While HPE has not confirmed whether the vulnerability is actively exploited, experts stress the importance of prompt patching. Rapid7 advises organizations to:
- Assume the vulnerability could be exploited at any moment.
- Review and strengthen network segmentation.
- Avoid considering management layers as inherently secure.
Final Notes
Given how managed platforms like OneView are often targeted by ransomware gangs and malware operators, immediate patching is crucial. Organizations relying on vulnerable versions should prioritize updating their systems to mitigate this high-severity threat.
---
Stay updated with HPE's official channels for further developments and patch releases.