CVE-2025-37164: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
A remote code execution issue exists in HPE OneView.
Other sources
Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
HPE OneViewfrom your environment.Discontinue use of the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions for HPE OneView.
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37164?
CVE-2025-37164 is classified as a maximum severity remote code execution vulnerability.
Which versions of HPE OneView are affected by CVE-2025-37164?
CVE-2025-37164 affects HPE OneView versions from 5.20 to 10.20 inclusive.
How do I fix CVE-2025-37164?
To address CVE-2025-37164, update HPE OneView to a version that exceeds 10.20.
What type of vulnerability is CVE-2025-37164?
CVE-2025-37164 is a remote code execution vulnerability.
Can exploiting CVE-2025-37164 lead to severe consequences?
Yes, exploiting CVE-2025-37164 can allow attackers to execute arbitrary code remotely, potentially leading to unauthorized access and control.