Latest HPE OneView vulnerability: CVE-2025-37164 #
HP Enterprise has reported a vulnerability in their OneView product. This flaw allows a remote, unauthenticated attacker to execute arbitrary code on the vulnerable system. Successful exploitation could allow complete system compromise.
This vulnerability has been assigned CVE-2025-37164 and is rated highly critical has a CVSS score of 10.0.
There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected
- All versions of HPE OneView 10.20 and prior
What is HPE? #
HPE OneView is a comprehensive IT infrastructure management application.
What is the impact? #
Successful exploitation of this vulnerability would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
HPE has released hotfix HPE_OV_CVE_37164_Z7550-98077 and has advised all users to apply this hotfix. Note that this hotfix does not apply to versions of HPE OneView 5.20, which may remain vulnerable. This hotfix must be reapplied after an appliance upgrade from HPE OneView version 6.60.xx to 7.00.00, including any HPE Synergy Composer reimage.
How to find potentially vulnerable systems with runZero #
From the Software inventory, use the following query to locate potentially vulnerable assets:
(vendor:="HP" AND product:="Oneview") OR (vendor:="HPE" AND product:="OneView")
