CVE-2025-37164: HPE OneView Unauthenticated Code Injection RCE

CVE-2025-37164 is a code injection vulnerability in an unauthenticated HPE OneView REST endpoint that lets a remote attacker run arbitrary code on the appliance with no credentials and no user interaction, and it has been exploited in the wild against a platform that holds centralized, privileged control over an organization's servers and firmware.

CVE-2025-37164 (CWE-94, code injection) affects HPE OneView, the infrastructure-management platform HPE describes as containing "a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution" (HPE Security Bulletin hpesbgn04985en_us).

Rapid7's technical analysis pinpoints the vulnerable surface as the /rest/id-pools/executeCommand REST API endpoint, which is reachable without authentication and accepts a cmd parameter in its JSON body that is executed on the host — the access vector that both triggers and confirms exploitation attempts. Rapid7 notes that because OneView "sits at a privileged control plane for enterprise infrastructure," successful exploitation grants "centralized control over servers, firmware, and lifecycle management at scale," not just code execution on one host (Rapid7: CVE-2025-37164 Critical Unauthenticated RCE Affecting HPE OneView).

NVD's own analysis scores the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; HPE's own CNA submission scores it 10.0 with a scope-changed vector, reflecting the same unauthenticated, network-exploitable severity by a slightly different impact model (NVD).

HPE published its advisory and hotfixes on 2025-12-16/17, covering versions 5.20 through 10.20.00; the hotfix applies an HTTP rule blocking access to the vulnerable endpoint, but the fix must be reapplied after upgrading from OneView 6.60.xx to 7.00.00 or after any HPE Synergy Composer reimage, and the 5.20 release line is not covered by the hotfix at all, leaving upgrade to 11.0 as the only full remediation for those systems (Rapid7).

CISA added CVE-2025-37164 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-01-07, with a required-action due date of 2026-01-28, citing active exploitation (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.9019 (99.796th percentile), consistent with a publicly exploited, unauthenticated RCE against an enterprise management plane with a public Metasploit module (FIRST EPSS).

Because OneView instances typically have broad administrative reach into server and firmware fleets, operators should treat any instance below 11.0 as compromised-by-default if internet-reachable, apply the hotfix or upgrade immediately, and re-verify the hotfix after every appliance upgrade or Synergy Composer reimage.

• HPE OneView contains a code injection vulnerability allowing a remote, unauthenticated user to perform remote code execution. — HPE Security Bulletin hpesbgn04985en_us
• The vulnerable endpoint is the unauthenticated /rest/id-pools/executeCommand REST API, which executes a 'cmd' parameter from the request body; exploitation grants centralized control over servers, firmware and lifecycle management. — Rapid7
• CVSS v3.1 base score is 9.8 (critical) per NVD's own analysis, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; HPE's CNA submission scores it 10.0 with a scope-changed vector. — NVD
• Affected: OneView 5.20 through 10.20.00 (all versions before 11.0); hotfix blocks the vulnerable endpoint but must be reapplied after upgrading from 6.60.xx to 7.00.00 or any Synergy Composer reimage; the 5.20 line is not covered by the hotfix. — Rapid7
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-01-07, due date 2026-01-28. — CISA KEV
• EPSS score is 0.9019 (99.796th percentile) as of 2026-10-29. — FIRST EPSS