CVE-2025-37164: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability

HPE OneView contains a code injection vulnerability that permits remote unauthenticated attackers to execute arbitrary code on affected systems. This weakness can lead to complete compromise of the management platform without requiring valid credentials. Organizations using HPE OneView for infrastructure management should treat this as a high-priority issue because successful exploitation grants attackers control over server and storage resources managed by the product.

How it works

The vulnerability is classified under CWE-94, improper control of generation of code. An attacker supplies input that the application treats as executable instructions rather than data.

• Because the flaw allows unauthenticated remote access, an attacker can reach the injection point without presenting valid credentials.
• Once the injected code executes, it runs in the context of the OneView process, enabling further actions on the host and any connected infrastructure.

Am I affected? How to find it in your systems

HPE OneView is typically deployed as a physical or virtual appliance that manages HPE server, storage, and networking hardware in data centers and private clouds. Begin by locating all instances through asset inventories, hypervisor listings, and network scans for management interfaces.

Confirm the precise versions and configuration details against the vendor advisory, as impact depends on those specifics. Examine web-access and application logs for unexpected unauthenticated requests to OneView endpoints; repeated or anomalous patterns may indicate reconnaissance or exploitation attempts.

How to remediate

Apply the software update referenced in the vendor advisory. This addresses the code-injection flaw directly and should be performed on every affected instance.

• Restrict network exposure of OneView management interfaces to only the minimal set of administrative workstations or jump hosts.
• Review any custom scripts or integrations that interact with OneView APIs for additional input-handling controls, while relying on the vendor patch for the core issue.

If you can't patch immediately

Implement mitigations exactly as described in the vendor instructions. Where OneView is used as a cloud service, follow applicable BOD 22-01 guidance. If suitable mitigations cannot be applied, discontinue use of the product until remediation is possible.

• Place the appliance behind network segmentation that permits only required management traffic from trusted sources.
• Enable enhanced monitoring for unusual process creation, file modifications, or outbound connections originating from the OneView host.

If your data may have been exposed

Remote code execution vulnerabilities have resulted in unauthorized access and subsequent data exposure in comparable management platforms. Organizations can run a free exposure scan of their email addresses to check against known breach data.