{"id":"hpe-oneview-code-injection-attacks-jan-2026","category":"patch","status":"closed","title":"HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released","tldr":"Attackers exploited HPE OneView, software businesses use to manage servers and other infrastructure. IT teams should upgrade to OneView 11.00 or later, or obtain HPE's enhanced January hotfix. Ordinary household devices are not affected.","summary":"CVE-2025-37164 lets an attacker who can reach a vulnerable HPE OneView appliance run code without logging in. OneView manages business servers, storage and networking; this affects workplace infrastructure rather than ordinary household computers. HPE's affected-version guidance covers releases before 11.00, with hotfixes available for versions 5.20 through 10.20. HPE says it released an initial hotfix on 17 December 2025 and an enhanced version on 15 January 2026. Check Point first detected attempts on 21 December and recorded more than 40,000 attempts on 7 January, attributing the surge to RondoDox. CISA listed the flaw as exploited that day. HPE subsequently said it had received no direct customer reports and that exploitation required access to the customer's network. The reports do not establish how many appliances were successfully compromised or that attacks have ended. HPE's live advisory could not be retrieved during this review; its statement and guidance quoted by the sources below were available.","action":"Nothing to update on ordinary family devices. If your business or family office uses HPE OneView, ask IT to confirm it runs version 11.00 or later, or has HPE's enhanced 15 January 2026 hotfix rather than relying on the original December patch, and to review the appliance for compromise.","product":"HPE OneView infrastructure management software","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-37164"],"tags":["hpe","oneview","code-injection","remote-code-execution","actively-exploited","rondodox"],"affected":["HPE OneView versions before 11.00 without the applicable security hotfix"],"fixed":["HPE OneView 11.00","HPE enhanced security hotfix released 2026-01-15 for affected earlier versions"],"matches":[],"sources":[{"kind":"news","title":"RondoDox botnet exploits HPE OneView vulnerability on a massive scale — includes HPE's statement","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine","date":"2026-01-16"},{"kind":"research","title":"CVE-2025-37164: Critical unauthenticated RCE affecting Hewlett Packard Enterprise OneView","url":"https://www.rapid7.com/blog/post/etr-cve-2025-37164-critical-unauthenticated-rce-affecting-hewlett-packard-enterprise-oneview/","by":"Rapid7","date":"2025-12-18"},{"kind":"research","title":"Patch Now: Active Exploitation Underway for Critical HPE OneView Vulnerability","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","date":"2026-01-15"},{"kind":"news","title":"Critical HPE OneView Vulnerability Exploited in Attacks","url":"https://www.securityweek.com/critical-hpe-oneview-vulnerability-exploited-in-attacks/amp/","by":"SecurityWeek","date":"2026-01-08"}],"started":"2026-01-07","closed":"2026-01-16","created":"2026-11-03T22:29:54.560Z","updated":"2026-11-03T22:29:54.560Z","cve_notes":[{"cve":"CVE-2025-37164","name":"Unauthenticated code execution in HPE OneView","what":"A code-injection flaw in HPE OneView allows an attacker with network access to the appliance to run their own code without logging in.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-01-16","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"HPE told Techzine it had received no direct customer reports of exploitation and said attackers needed access to the customer's network. This differed from Check Point's independently observed attack activity; neither report established a total of successfully compromised appliances.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":null},{"at":"2026-01-15","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"HPE released an enhanced hotfix, according to its subsequent statement to Techzine.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":"patched"},{"at":"2026-01-07T05:45Z","added":"2026-11-03T22:23:55.101Z","kind":"wider-attacks","text":"Between 05:45 and 09:20 UTC, Check Point recorded more than 40,000 attack attempts, which it attributed to the RondoDox botnet. Targets included organisations in Australia.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null},{"at":"2026-01-07","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2025-37164 to its Known Exploited Vulnerabilities catalogue, confirming evidence of attacks.","url":"https://www.rapid7.com/blog/post/etr-cve-2025-37164-critical-unauthenticated-rce-affecting-hewlett-packard-enterprise-oneview/","by":"Rapid7","patch":null},{"at":"2025-12-21","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"Check Point detected its first exploitation attempts that evening, after deploying protection for the flaw.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null},{"at":"2025-12-17","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"HPE says it released an initial hotfix on this date. This was subsequently superseded by enhanced remediation in January.","url":"https://www.techzine.eu/news/security/138004/rondodox-botnet-exploits-hpe-oneview-vulnerability-on-a-massive-scale/","by":"Techzine, quoting HPE","patch":"partial"},{"at":"2025-12-16","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"HPE disclosed CVE-2025-37164 in OneView, its business infrastructure management software. The flaw allows someone who can reach a vulnerable appliance to run code without logging in.","url":"https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/","by":"Check Point Research","patch":null}],"url":"https://hard.fyi/live/hpe-oneview-code-injection-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=hpe-oneview-code-injection-attacks-jan-2026"}