ZDI-25-325: Hewlett Packard Enterprise Insight Remote Support processAttachmentDataStream Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise Insight Remote Support. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-37099.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-325?
The severity of ZDI-25-325 is rated as 9.8 on the CVSS scale, indicating a critical vulnerability.
How do I fix ZDI-25-325?
To fix ZDI-25-325, update your installation of Hewlett Packard Enterprise Insight Remote Support to the latest version provided by the vendor.
What type of attack does ZDI-25-325 enable?
ZDI-25-325 allows remote attackers to execute arbitrary code without authentication.
Are all versions of Hewlett Packard Enterprise Insight Remote Support affected by ZDI-25-325?
Yes, all installations of Hewlett Packard Enterprise Insight Remote Support are susceptible to ZDI-25-325.
How can I determine if I am vulnerable to ZDI-25-325?
You can determine vulnerability to ZDI-25-325 by checking if you are running an affected version of Hewlett Packard Enterprise Insight Remote Support.