RondoDox Botnet Exploits Critical HPE OneView Vulnerability CVE-2025-37164

Check Point has linked the RondoDox botnet to large-scale exploitation of CVE-2025-37164, a severe remote code execution vulnerability in HPE’s OneView data center management platform. The flaw was disclosed by HPE in mid-December, receiving immediate attention due to its maximum severity score of 10 on the CVSS scale. This vulnerability allows attackers to control servers, storage, and networking from a central point, making it a high-risk target for enterprises.

On January 7, following the flaw’s addition to CISA’s list of actively exploited vulnerabilities, Check Point observed a dramatic increase in attack attempts, with over 40,000 recorded in just a few hours. The attacks were identified as automated and botnet-driven, indicating a coordinated effort to exploit the vulnerability across various systems.

The majority of these attacks originated from a single Dutch IP address, suggesting a particularly active threat actor behind the RondoDox botnet. The attacks were not limited to one region; they were global, with the highest volume in the United States, followed by Australia, France, Germany, and Austria. Government organizations, financial services, and industrial manufacturers were primarily targeted.

HPE has urged OneView users to apply the patch immediately, emphasizing the importance of timely updates to management platforms. The rapid escalation of exploit attempts serves as a reminder that vulnerabilities can be quickly weaponized by adversaries, and organizations must remain vigilant in their patch management practices.

Implications for Organizations

This incident underscores the critical need for organizations to prioritize patch management for their infrastructure. The exploitation of high-severity vulnerabilities like CVE-2025-37164 can lead to significant risks, including unauthorized access to sensitive data and potential disruptions to operations.

Organizations should monitor their systems for any signs of exploitation and ensure that all software is up to date. The use of automated scanners by attackers highlights the need for proactive security measures, including regular vulnerability assessments and threat intelligence monitoring.

In light of this event, it is essential for IT teams to review their incident response plans and ensure they are prepared to address potential breaches stemming from such vulnerabilities. The RondoDox botnet’s activity serves as a warning that cyber threats are evolving, and organizations must adapt their security strategies accordingly.