HPE OneView code-execution flaw CVE-2025-37164 exploited by RondoDox; enhanced hotfix released
Attackers exploited HPE OneView, software businesses use to manage servers and other infrastructure. IT teams should upgrade to OneView 11.00 or later, or obtain HPE's enhanced January hotfix. Ordinary household devices are not affected.
Nothing to update on ordinary family devices. If your business or family office uses HPE OneView, ask IT to confirm it runs version 11.00 or later, or has HPE's enhanced 15 January 2026 hotfix rather than relying on the original December patch, and to review the appliance for compromise.
What’s happening
CVE-2025-37164 lets an attacker who can reach a vulnerable HPE OneView appliance run code without logging in. OneView manages business servers, storage and networking; this affects workplace infrastructure rather than ordinary household computers. HPE's affected-version guidance covers releases before 11.00, with hotfixes available for versions 5.20 through 10.20. HPE says it released an initial hotfix on 17 December 2025 and an enhanced version on 15 January 2026. Check Point first detected attempts on 21 December and recorded more than 40,000 attempts on 7 January, attributing the surge to RondoDox. CISA listed the flaw as exploited that day. HPE subsequently said it had received no direct customer reports and that exploitation required access to the customer's network. The reports do not establish how many appliances were successfully compromised or that attacks have ended. HPE's live advisory could not be retrieved during this review; its statement and guidance quoted by the sources below were available.
- What
- Flaw
- Affects
- HPE OneView infrastructure management software
- Affected
- HPE OneView versions before 11.00 without the applicable security hotfix
- Fixed in
- HPE OneView 11.00
HPE enhanced security hotfix released 2026-01-15 for affected earlier versions - Since
- 7 Jan 2026
- Closed
- 16 Jan 2026
Timeline
- Update
HPE told Techzine it had received no direct customer reports of exploitation and said attackers needed access to the customer's network. This differed from Check Point's independently observed attack activity; neither report established a total of successfully compromised appliances.
- New fixFixed
HPE released an enhanced hotfix, according to its subsequent statement to Techzine.
- Wider attacks
Between 05:45 and 09:20 UTC, Check Point recorded more than 40,000 attack attempts, which it attributed to the RondoDox botnet. Targets included organisations in Australia.
- CISA added
CISA added CVE-2025-37164 to its Known Exploited Vulnerabilities catalogue, confirming evidence of attacks.
- Update
Check Point detected its first exploitation attempts that evening, after deploying protection for the flaw.
- New fixPartly fixed
HPE says it released an initial hotfix on this date. This was subsequently superseded by enhanced remediation in January.
- Made public
HPE disclosed CVE-2025-37164 in OneView, its business infrastructure management software. The flaw allows someone who can reach a vulnerable appliance to run code without logging in.
Sources
- RondoDox botnet exploits HPE OneView vulnerability on a massive scale — includes HPE's statementTechzine · 16 Jan 2026
- CVE-2025-37164: Critical unauthenticated RCE affecting Hewlett Packard Enterprise OneViewRapid7 · 18 Dec 2025
- Patch Now: Active Exploitation Underway for Critical HPE OneView VulnerabilityCheck Point Research · 15 Jan 2026
- Critical HPE OneView Vulnerability Exploited in AttacksSecurityWeek · 8 Jan 2026