PoC released for HPE OneView Vulnerability (CVE-2025-37164)

THE THREAT

On December 16th, 2025, Hewlett Packard Enterprise (HPE) disclosed a critical vulnerability in HPE OneView. CVE-2025-37164 (CVSS: 10) is an unauthenticated Remote Code Execution (RCE) vulnerability impacting versions of HPE OneView before 11.0. A detailed Proof-of-Concept (PoC) exploit code was released by Rapid7 following the disclosure. Successful exploitation may allow threat actors to execute arbitrary code, potentially resulting in full network compromise, data theft, or malware deployment.

Although there are no reports of active exploitation at the time of writing, public availability of PoC exploit code significantly increases the risk to organizations running affected versions of the application. As the vulnerability impacts all versions prior to 11.0, organizations are strongly advised to apply the required updates to mitigate the potential risk of exploitation.

What we're doing about it

• eSentire MDR for Network has detections in place to identify exploitation of CVE-2025-37164
• eSentire's Threat Response Unit (TRU) is actively tracking this topic for additional detection opportunities
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available

What you should do about it

• Upgrade to HPE OneView version 11.0
• If an upgrade is not feasible, apply the emergency hotfix for HPE OneView versions 5.20 through 10.20
  • Reapplication of the hotfix is required if HPE OneView is upgraded from version 6.60.xx to 7.00.00, or if an HPE Synergy Composer reimage is performed
  • Relevant hotfixes are available via the HPE OneView Virtual Appliance Security Hotfix and HPE Synergy CVE Security Hotfix portals
• Restrict access to management infrastructure to trusted IP addresses only
• Regularly monitor access logs for any suspicious activity

Additional information

HPE OneView is an IT infrastructure management software that provides centralized control over IT operations, including managing data center networks and servers through a unified dashboard interface. In its advisory, Rapid7 noted that "the real concern here is exposure and trust assumptions," highlighting the application's central role within the environment and the potential impact of exploiting a trusted component that is integral to network operations. Rapid7 released a Metasploit module demonstrating the exploitation of CVE-2025-37164.

The PoC exploit code indicates that the vulnerability exists within the ID Pools feature of HPE OneView. The API associated with this feature processes command execution requests without requiring authentication, allowing unauthenticated callers to supply and execute commands. Rapid7's finding indicates that, despite the HPE advisory stating that all HPE OneView versions prior to 11.0 are vulnerable, the ID Pools feature is not present across all editions. Rapid7 noted in its assessment that this observation requires clarification and confirmation from HPE and does not eliminate the need for patching as a mitigation measure.

Due to the high risk associated with CVE-2025-37164, organizations should remediate the vulnerability by upgrading to a secure version or applying the appropriate hotfix. Additionally, restrict access to management interfaces to prevent exposure to the Internet or untrusted networks, review access logs for suspicious activity, and rotate any potentially exposed credentials or secrets.

References:
[1] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-37164
[3] https://attackerkb.com/topics/ixWdbDvjwX/cve-2025-37164/rapid7-analysis
[4] https://myenterpriselicense.hpe.com/cwp-ui/product-details/HPE_OV_CVE_37164_Z7550-98077/-/sw_free
[5] https://support.hpe.com/hpesc/public/swd/detail?swCollectionId=MTX-64daeb5ed0df44a0
[6] https://www.rapid7.com/blog/post/etr-cve-2025-37164-critical-unauthenticated-rce-affecting-hewlett-packard-enterprise-oneview/
[7] https://github.com/rapid7/metasploit-framework/pull/20792