40,000 Hits in 4 Hours: RondoDox Botnet Storms HPE OneView

On 16 January 2026, according to Check Point Research, a massive automated assault on HPE OneView was observed, with a botnet launching over 40,000 exploitation attempts in four hours targeting a critical CVE-2025-37164 flaw. The campaign is attributed to the RondoDox botnet, a Linux-based group previously identified in mid-2025 that targets IoT devices and web servers for DDoS attacks and cryptocurrency mining.

The vulnerability lies within the executeCommand REST API endpoint of HPE OneView’s “id-pools” functionality, which the report notes accepts attacker-supplied input without authentication or authorization checks and executes it directly via the underlying operating system runtime. Hewlett Packard Enterprise published an advisory on 16 December 2025, and activity surged on 7 January 2026 between 05:45 and 09:20 UTC, marking a dramatic escalation from early probing to large‑scale exploitation.

Check Point reported the exploitation to CISA, after which the vulnerability was added to the Known Exploited Vulnerabilities catalog, with organisations running HPE OneView urged to patch immediately.