CISA Flags HPE OneView Vulnerability CVE-2025-37164 as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a maximum-severity vulnerability in HPE OneView, identified as CVE-2025-37164, which is currently being exploited in the wild. This critical security flaw was reported by Vietnamese security researcher Nguyen Quoc Khanh and affects all OneView versions released before v11.00. It allows unauthenticated threat actors to perform low-complexity code-injection attacks, resulting in remote code execution on systems that have not been patched.

HPE released security patches for this vulnerability in mid-December 2024, advising customers to upgrade to OneView version 11.00 or later. CISA has added CVE-2025-37164 to its catalog of known exploited vulnerabilities, giving Federal Civilian Executive Branch (FCEB) agencies until January 28, 2025, to secure their systems as per the Binding Operational Directive (BOD) 22-01. Although this directive specifically targets federal agencies, CISA has encouraged all organizations, including those in the private sector, to address this vulnerability promptly.

HPE has a history of addressing vulnerabilities, having previously warned about hardcoded credentials in Aruba Instant On Access Points and patched multiple vulnerabilities in its StoreOnce solution. The company reported revenues of $30.1 billion in 2024 and serves over 55,000 organizations, including 90% of Fortune 500 companies.

Understanding the Risks

The exploitation of CVE-2025-37164 highlights a significant risk for organizations that rely on HPE OneView for infrastructure management. The ability for attackers to execute code remotely without authentication poses a severe threat, especially for organizations that may not have updated their systems. This incident underscores the importance of timely software updates and patch management.

Organizations should be particularly vigilant about monitoring their systems for signs of exploitation and ensure they are following vendor instructions for applying security patches. The lack of workarounds or mitigations for this vulnerability means that upgrading to the latest version is critical for maintaining security.