PoC Available: Unauthenticated HPE OneView RCE (CVSS 10.0) Exploits Hidden ID Pools API

Security researchers have disclosed a maximum-severity vulnerability in Hewlett Packard Enterprise’s OneView software, tracked as CVE-2025-37164, which enables unauthenticated remote code execution and affects OneView versions prior to v11.00. The flaw centres on the ID Pools feature, where the REST endpoint /rest/id-pools/executeCommand was configured with auth-type="NO_AUTH", bypassing authentication checks.

The endpoint accepts a JSON payload with a command string (cmd) and passes it to Runtime[.]exec, allowing the execution of system commands. In tests, a simple malicious PUT request could open a reverse shell on vulnerable systems where the ID Pools feature is active, granting the attacker access as the trm3 user and, due to SELinux policies, leaving that user unconfined.

Whether a given system is affected depends on the product branch: the vulnerability appears in HPE OneView for VMs in the legacy 6.x branch and in HPE OneView for Synergy across versions. HPE has released OneView v11.00 to address the flaw, with hotfixes available for versions 5.20 through 10.20 for those unable to upgrade immediately. The disclosure notes a Metasploit module for CVE-2025-37164 is available, highlighting the ease of exploitation. Published 20 December 2025.