Back to overview

CVE-2025-37164

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.1
Description
A remote code execution issue exists in HPE OneView.

Metadata

CVE ID
CVE-2025-37164
State
PUBLISHED
Assigner
hpe
Reserved
2025-04-16 01:28 UTC
Published
2025-12-16 16:30 UTC
Last updated
2026-02-26 16:07 UTC
Primary CWE
CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product
Hewlett Packard Enterprise (HPE) / HPE OneView
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
Vendor
Hewlett Packard Enterprise (HPE)
Product
OneView
Added to KEV
2026-01-07
Due date
2026-01-28
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA description
Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.
Affected products (1)
VendorProductPlatformVersions
Hewlett Packard Enterprise (HPE) HPE OneView — 0 < 11.00
Weakness (CWE)
CWESourceDescription
CWE-94 adp CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview