ZDI-25-314: Hewlett Packard Enterprise StoreOnce VSA doExecute Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise StoreOnce VSA. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2025-37091.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-314?
The ZDI-25-314 vulnerability is considered critical due to its potential for remote code execution.
How do I fix ZDI-25-314?
To mitigate the ZDI-25-314 vulnerability, ensure that you apply the latest patches provided by Hewlett Packard Enterprise for StoreOnce VSA.
Who is affected by ZDI-25-314?
ZDI-25-314 affects installations of Hewlett Packard Enterprise StoreOnce VSA that have not implemented the necessary security updates.
Can authentication bypass occur with ZDI-25-314?
Yes, the ZDI-25-314 vulnerability allows attackers to bypass the existing authentication mechanism and execute arbitrary code.
What type of attacks can occur through ZDI-25-314?
ZDI-25-314 enables remote attackers to execute arbitrary code, potentially leading to system compromise.