CVE-2025-37164

10.0

CRITICAL CVSS 3.1

Hewlett Packard Enterprise OneView Code Injection Vulnerability - [Actively Exploited]

Description

A remote code execution issue exists in HPE OneView.

INFO

Published Date :

Dec. 16, 2025, 5:16 p.m.

Last Modified :

Jan. 8, 2026, 4:59 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Jan 28, 2026

Alert Date: Jan 07, 2026 | 20 days ago

Description :

Hewlett Packard Enterprise OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2025-37164

Affected Products

The following products are affected by CVE-2025-37164 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Hp	oneview
1	Hpe	oneview

: Total Affected Vendor : 2 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	eb103674-0d28-4225-80f8-39fb86215de0
CVSS 3.1	CRITICAL	[email protected]
CVSS 3.1	CRITICAL	[email protected]

Solution

Address the remote code execution vulnerability in HPE OneView.

Apply the latest security patches from HPE.
Update HPE OneView to the newest version.
Review HPE security advisories for mitigation.
Restrict access to affected HPE OneView systems.

Public PoC/Exploit Available at Github

CVE-2025-37164 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-37164.

URL	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US	Vendor Advisory
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb	Exploit
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-37164	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-37164 is associated with the following CWEs:

CWE-94: Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-37164 weaknesses.

CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-242: Code Injection Code Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

LACHHAB-Anas/Exploit_CVE-2025-37164

Exploit for the CVE-2025-37164

Python

Updated: 2 weeks, 6 days ago

1 stars 0 fork 0 watcher

Born at : Jan. 6, 2026, 10:23 p.m. This repo has been linked 1 different CVEs too.

yt2w/CVE-2025-37164

HPE OneView Unauthenticated Remote Code Execution (CVSS 10.0)

Python

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Dec. 20, 2025, 3:21 p.m. This repo has been linked 1 different CVEs too.

g0vguy/CVE-2025-37164-PoC

PoC for CVE-2025-37164

Python

Updated: 1 month ago

5 stars 1 fork 1 watcher

Born at : Dec. 19, 2025, 10 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-37164

Detection for CVE-2025-37164

hp rce vulnerability

Updated: 1 month, 1 week ago

2 stars 0 fork 0 watcher

Born at : Dec. 18, 2025, 1:41 p.m. This repo has been linked 1 different CVEs too.

hsvhora/research_blogs

Links of research blogs published by me.

Updated: 4 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 16, 2025, 9:30 a.m. This repo has been linked 23 different CVEs too.

CryptoGenNepal/CVE-KEV-RSS

CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.

cve json rss cgn cisa kev

Python HTML

Updated: 2 weeks, 3 days ago

3 stars 1 fork 1 watcher

Born at : Feb. 16, 2025, 5:21 p.m. This repo has been linked 2 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 2 weeks, 3 days ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 11 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 3 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 39 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks, 3 days ago

7462 stars 1233 fork 1233 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 826 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-37164 vulnerability anywhere in the article.

Daily CyberSecurity

High-Severity DoS Flaw Hits Google Protocol Buffers (CVE-2026-0994)

A high-severity vulnerability has been discovered in Protocol Buffers (protobuf), Google’s widely used mechanism for serializing structured data. The flaw, tracked as CVE-2026-0994, affects Python imp ...

Published Date: Jan 27, 2026 (15 hours, 26 minutes ago)

Daily CyberSecurity

Industrial Alert: Critical RCE in AVEVA Software Rated CVSS 10

AVEVA, a global leader in industrial software, has issued a critical security bulletin regarding its flagship Process Optimization software (formerly known as ROMeo). The alert details multiple vulner ...

Published Date: Jan 20, 2026 (1 week ago)

Daily CyberSecurity

CVE-2026-0695: High-Severity XSS Flaw Patched in ConnectWise PSA 2026.1

ConnectWise has released a crucial security update for its Professional Services Automation (PSA) platform, addressing two significant vulnerabilities that could allow attackers to weaponize mundane a ...

Published Date: Jan 19, 2026 (1 week, 1 day ago)

Daily CyberSecurity

40,000 Hits in 4 Hours: RondoDox Botnet Storms HPE OneView

Check Point Research uncovered a massive, automated assault on HPE OneView. Researchers observed a botnet launching over 40,000 exploitation attempts in a span of just four hours, targeting a critical ...

Published Date: Jan 16, 2026 (1 week, 4 days ago)

Help Net Security

Week in review: PoC for Trend Micro Apex Central RCE released, Patch Tuesday forecast

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Pharma’s most underestimated cyber risk isn’t a breach Chirag Shah, Global Information Security Office ...

Published Date: Jan 11, 2026 (2 weeks, 2 days ago)

TheCyberThrone

HPE OneView RCE CVE-2025-37164 Added to CISA KEV

January 11, 2026A critical unauthenticated remote code execution vulnerability in HPE OneView, tracked as CVE-2025-37164, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to ...

Published Date: Jan 11, 2026 (2 weeks, 2 days ago)

hackread.com

CISA Urges Emergency Patching for Actively Exploited HPE OneView Flaw

If your office uses Hewlett Packard Enterprise (HPE) OneView to manage its servers and networking, you need to check your software version immediately. A major security flaw has been discovered that e ...

Published Date: Jan 10, 2026 (2 weeks, 3 days ago)

Help Net Security

January 2026 Patch Tuesday forecast: And so it continues

Welcome to a new year of my Patch Tuesday forecast blog where I provide a summary of Microsoft and other vendor’s security patch activity (and reported issues) for the month, talk about some of the la ...

Published Date: Jan 09, 2026 (2 weeks, 4 days ago)

Help Net Security

Recently fixed HPE OneView flaw is being exploited (CVE-2025-37164)

An unauthenticated remote code execution vulnerability (CVE-2025-37164) affecting certain versions of HPE OneView is being leveraged by attackers, CISA confirmed by adding the flaw to its Known Exploi ...