Cyber Resilience

CVE-2025-37096

HighRCE

Published: 02 June 2025

Published
02 June 2025
Modified
02 July 2025
KEV Added
—
Patch
—
CVSS Score v4 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0116 79.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-37096 is a high-severity Command Injection (CWE-77) vulnerability in Hpe Storeonce System. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 21.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A command injection remote code execution vulnerability tracked as CVE-2025-37096 affects HPE StoreOnce Software. The flaw, assigned CWE-77, carries a CVSS 4.0 score of 7.5 and permits an attacker to inject and execute arbitrary commands on the affected system.

Exploitation requires network access and high privileges but low attack complexity. An authenticated administrator or equivalent privileged user can leverage the injection to achieve full remote code execution, resulting in high impact to confidentiality, integrity, and availability of the StoreOnce appliance.

HPE has published an advisory detailing the issue at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04847en_us&docLocale=en_US. The EPSS score remains flat at 0.0116 with no observed rise after disclosure.

EU & UK References

Vulnerability details

A command injection remote code execution vulnerability exists in HPE StoreOnce Software.

CWE(s)
CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hpe
storeonce system
≤ 4.3.11

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References