CVE-2025-11531
Published: 09 December 2025
Summary
CVE-2025-11531 is a medium-severity Path Traversal (CWE-22) vulnerability in Hp Omen Gaming Hub. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-11531 is a path traversal vulnerability (CWE-22) affecting HP System Event Utility and Omen Gaming Hub. These components might allow execution of certain files outside of their restricted paths, enabling potential unauthorized access or code execution. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
An attacker with low privileges (PR:L) on the affected system can exploit this vulnerability over the network (AV:N) with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary files outside the intended restricted paths, potentially granting high-level compromise including data theft, modification, or system disruption.
The HP security bulletin at https://support.hp.com/us-en/document/ish_13537533-13537555-16/hpsbgn04079 details the remediation, which applies to HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0. Security practitioners should prioritize updating to these versions to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202312
Vulnerability details
HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables low-privilege remote attackers to execute arbitrary files, directly facilitating exploitation for privilege escalation (T1068) and exploitation of remote services (T1210).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the path traversal vulnerability by requiring timely identification, reporting, and patching of flaws like this one, with remediation via specific HP software updates.
Enforces approved authorizations for access to files and paths, preventing execution of arbitrary files outside restricted directories as exploited in this CVE.
Validates inputs to applications like HP System Event Utility and Omen Gaming Hub, blocking path traversal sequences that enable unauthorized file execution.