CVE-2025-37164

HPE OneView contains a remote code execution flaw that lets an attacker run arbitrary code on the management platform. HPE's advisory is sparse on mechanism, but the CVSS profile — network-reachable, no privileges, no user interaction, with a scope change — indicates an unauthenticated request against the OneView interface leads to code execution beyond the initially compromised component.

OneView is infrastructure-management software: it provisions, monitors, and controls servers, storage, and networking across a data center, so it holds privileged credentials for and command over a large fleet of hardware. Code execution on the OneView appliance is therefore not a single-host problem but a lever over everything it manages, exactly the kind of centralized control plane an attacker most wants. Apply HPE's fixed version promptly and keep the OneView management interface confined to an isolated administrative network with no internet exposure, following HPE's own guidance to segregate management traffic. Given the severity and the platform's reach, rotate the credentials OneView uses to reach managed systems if exposure is suspected, and restrict administrative access to a minimal set of trusted hosts.