CVE-2025-37092
Published: 02 June 2025
Summary
CVE-2025-37092 is a high-severity Command Injection (CWE-77) vulnerability in Hpe Storeonce System. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 21.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A command injection remote code execution vulnerability tracked as CVE-2025-37092 exists in HPE StoreOnce Software and is classified under CWE-77. The flaw received a CVSS 4.0 score of 7.5 with a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when preconditions are met.
An attacker with high privileges can exploit the issue remotely to inject operating-system commands, resulting in arbitrary code execution on the target appliance.
The referenced HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US provides the official advisory and any associated remediation steps. Exploitation probability remains low, with an EPSS score of 0.0116 that has shown no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16656
Vulnerability details
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.