ZDI-25-315: Hewlett Packard Enterprise StoreOnce VSA queryHardwareReportLocally Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise StoreOnce VSA. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2025-37092.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-315?
ZDI-25-315 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix ZDI-25-315?
To mitigate ZDI-25-315, update the Hewlett Packard Enterprise StoreOnce VSA to the latest patched version provided by HPE.
Who is affected by ZDI-25-315?
Any organization using vulnerable versions of the Hewlett Packard Enterprise StoreOnce VSA is at risk from ZDI-25-315.
Can ZDI-25-315 be exploited without authentication?
No, ZDI-25-315 requires authentication, but the current authentication mechanism can be bypassed.
What kind of attacks can be carried out using ZDI-25-315?
ZDI-25-315 allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise.