ZDI-CAN-25790: ZDI-25-613: Hewlett Packard Enterprise AutoPass License Server Hard-coded Credentials Authentication Bypass Vulnerability

Published Jul 17, 2025

Updated

This vulnerability allows remote attackers to disclose sensitive information or edit configuration on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2025-37106.

Affected Software

1 affected component

Hewlett Packard Enterprise AutoPass License Server

Event History

Jul 17, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25790?

The severity of ZDI-CAN-25790 is rated at 7.3 on the CVSS scale.

What type of attack does ZDI-CAN-25790 allow?

ZDI-CAN-25790 allows remote attackers to disclose sensitive information or edit configuration.

Is authentication required to exploit ZDI-CAN-25790?

No, authentication is not required to exploit ZDI-CAN-25790.

What software is affected by ZDI-CAN-25790?

The affected software for ZDI-CAN-25790 is Hewlett Packard Enterprise AutoPass License Server.

How can organizations protect against ZDI-CAN-25790?

Organizations can protect against ZDI-CAN-25790 by applying security patches and implementing network security measures.