1. Home
  2. Vulnerabilities
  3. CVE-2025-37164
10.0
CRITICAL CVSS 3.1
CVE-2025-37164
HPE OneView Remote Code Execution Vulnerability
Description

A remote code execution issue exists in HPE OneView.

INFO

Published Date :

Dec. 16, 2025, 5:16 p.m.

Last Modified :

Dec. 31, 2025, 12:29 a.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Affected Products

The following products are affected by CVE-2025-37164 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Hp oneview
1 Hpe oneview
: Total Affected Vendor : 2 | Products : 2
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL eb103674-0d28-4225-80f8-39fb86215de0
CVSS 3.1 CRITICAL [email protected]
CVSS 3.1 CRITICAL [email protected]
Solution
Address the remote code execution vulnerability in HPE OneView.
  • Apply the latest security patches from HPE.
  • Update HPE OneView to the newest version.
  • Review HPE security advisories for mitigation.
  • Restrict access to affected HPE OneView systems.
Public PoC/Exploit Available at Github

CVE-2025-37164 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-37164.

URL Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn4985en_us&docLocale=en_US Permissions Required
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb Product
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1 Vendor Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-37164 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-37164 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
LACHHAB-Anas/Exploit_CVE-2025-37164

Exploit for the CVE-2025-37164

Python

Updated: 7 hours, 55 minutes ago
1 stars 0 fork 0 watcher
Born at : Jan. 6, 2026, 10:23 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
yt2w/CVE-2025-37164

HPE OneView Unauthenticated Remote Code Execution (CVSS 10.0)

Python

Updated: 2 weeks, 3 days ago
0 stars 0 fork 0 watcher
Born at : Dec. 20, 2025, 3:21 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
g0vguy/CVE-2025-37164-PoC

PoC for CVE-2025-37164

Python

Updated: 1 week, 5 days ago
5 stars 1 fork 1 watcher
Born at : Dec. 19, 2025, 10 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
rxerium/CVE-2025-37164

Detection for CVE-2025-37164

hp rce vulnerability

Updated: 2 weeks, 5 days ago
2 stars 0 fork 0 watcher
Born at : Dec. 18, 2025, 1:41 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
hsvhora/research_blogs

Links of research blogs published by me.

Updated: 1 week, 1 day ago
0 stars 0 fork 0 watcher
Born at : April 16, 2025, 9:30 a.m. This repo has been linked 23 different CVEs too.
Profile Photo
rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 6 days, 4 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 39 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 12 hours ago
7462 stars 1233 fork 1233 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 827 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-37164 vulnerability anywhere in the article.

  • Daily CyberSecurity
Aiohttp Patches Seven Vulnerabilities Including High-Severity DoS Risks

Maintainers of aiohttp, the popular asynchronous HTTP client/server framework for Python, have released a sweeping security update addressing seven distinct vulnerabilities. The update, version 3.13.3 ... Read more

Published Date: Jan 06, 2026 (1 day, 4 hours ago)
  • Daily CyberSecurity
CVE-2025-66848: Critical Flaw in JD Cloud Routers Grants Hackers Root Access

A security vulnerability has been uncovered in a popular line of NAS routers from JD Cloud, potentially leaving thousands of home and business networks wide open to attack. The flaw, which affects mul ... Read more

Published Date: Jan 05, 2026 (2 days, 6 hours ago)
  • Daily CyberSecurity
CVE-2025-52691 (CVSS 10): Critical SmarterMail Flaw Opens Servers to Unauthenticated Attacks

The Cyber Security Agency of Singapore (CSA) has issued an urgent alert regarding a catastrophic vulnerability in SmarterMail, a popular enterprise alternative to Microsoft Exchange. The security flaw ... Read more

Published Date: Dec 30, 2025 (1 week, 1 day ago)
  • Daily CyberSecurity
“Headphone Jacking”: Critical Flaws in Popular Earbuds Let Hackers Hijack Your Phone

Your Bluetooth headphones might be doing more than just playing your favorite tunes—they could be handing over the keys to your digital life. A new report from ERNW Enno Rey Netzwerke GmbH has exposed ... Read more

Published Date: Dec 29, 2025 (1 week, 2 days ago)
  • CybersecurityNews
PoC Exploit Released HPE OneView Vulnerability that Enables Remote Code Execution

Security researchers have released a Proof-of-Concept (PoC) exploit for a critical vulnerability in HPE OneView, a popular IT infrastructure management platform. The flaw, tracked as CVE-2025-37164, c ... Read more

Published Date: Dec 23, 2025 (2 weeks ago)
  • Daily CyberSecurity
PoC Available: Unauthenticated HPE OneView RCE (CVSS 10.0) Exploits Hidden ID Pools API

Security researchers have detailed a maximum-severity vulnerability in Hewlett Packard Enterprise’s (HPE) OneView software, revealing how a seemingly obscure feature could allow unauthenticated attack ... Read more

Published Date: Dec 20, 2025 (2 weeks, 3 days ago)
  • The Register
HPE tells customers to patch fast as OneView RCE bug scores a perfect 10

Hewlett Packard Enterprise has told customers to drop whatever they're doing and patch OneView after admitting a maximum-severity bug could let attackers run code on the management platform without so ... Read more

Published Date: Dec 19, 2025 (2 weeks, 4 days ago)
  • The Hacker News
HPE OneView Flaw Rated CVSS 10.0 Allows Unauthenticated Remote Code Execution

Dec 18, 2025Ravie LakshmananVulnerability / Enterprise Security Hewlett Packard Enterprise (HPE) has resolved a maximum-severity security flaw in OneView Software that, if successfully exploited, co ... Read more

Published Date: Dec 18, 2025 (2 weeks, 5 days ago)
  • CybersecurityNews
HPE OneView Software Vulnerability Let Attackers Execute Remote Code

A critical security alert warns customers about a severe vulnerability in HPE OneView Software that could allow remote attackers to execute arbitrary code without authentication. The flaw, tracked as ... Read more

Published Date: Dec 18, 2025 (2 weeks, 5 days ago)
  • BleepingComputer
HPE warns of maximum severity RCE flaw in OneView software

Hewlett Packard Enterprise (HPE) has patched a maximum-severity vulnerability in its HPE OneView software that enables attackers to execute arbitrary code remotely. OneView is HPE's infrastructure man ... Read more

Published Date: Dec 18, 2025 (2 weeks, 5 days ago)
  • Daily CyberSecurity
The Developer Win: GitHub Postpones Self-Hosted Runner Fee After Massive Community Outcry

Recently, the code hosting platform GitHub published a blog post announcing that, starting March 1, 2026, GitHub Actions would begin charging an additional platform fee. Under the proposed change, dev ... Read more

Published Date: Dec 18, 2025 (2 weeks, 6 days ago)
  • Daily CyberSecurity
CVE-2025-37164 (CVSS 10.0): Unauthenticated HPE OneView RCE Grants Total Control Over Data Centers

Hewlett Packard Enterprise (HPE) has sounded the alarm on a catastrophic security vulnerability in its flagship infrastructure management software, OneView. The flaw, tracked as CVE-2025-37164, has be ... Read more

Published Date: Dec 18, 2025 (2 weeks, 6 days ago)
  • Daily CyberSecurity
CISA Alert: Chinese Hackers Weaponize CVSS 10 Cisco Zero-Day & SonicWall Exploit Chains

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive adding three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that ha ... Read more

Published Date: Dec 18, 2025 (2 weeks, 6 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-37164 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Dec. 31, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CPE Configuration OR *cpe:2.3:a:hpe:oneview:*:*:*:*:*:*:*:* versions from (including) 5.20 up to (including) 10.20
    Added Reference Type Hewlett Packard Enterprise (HPE): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn4985en_us&docLocale=en_US Types: Permissions Required
    Added Reference Type CISA-ADP: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb Types: Product
    Added Reference Type CISA-ADP: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1 Types: Vendor Advisory
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Dec. 23, 2025

    Action Type Old Value New Value
    Added Reference https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hpe_oneview_rce.rb
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Dec. 18, 2025

    Action Type Old Value New Value
    Added Reference https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US#vulnerability-summary-1
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Dec. 16, 2025

    Action Type Old Value New Value
    Added CWE CWE-94
  • New CVE Received by [email protected]

    Dec. 16, 2025

    Action Type Old Value New Value
    Added Description A remote code execution issue exists in HPE OneView.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added Reference https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn4985en_us&docLocale=en_US
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 10
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact