this is already the worst bug of 2026

Quick Overview

The critical vulnerability CVE-2025-37164 in HPE OneView is an unauthenticated Remote Code Execution (RCE) flaw exploitable via a command injection vulnerability in the REST API endpoint /rest/id-pools/executeCommand, which allowed the presenter to gain a root shell on the target system using a Metasploit module.

Key Points: CVE-2025-37164 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Hewlett Packard Enterprise (HPE) OneView. The vulnerability stems from a command injection flaw in the REST API endpoint /rest/id-pools/executeCommand, which was reachable without authentication. The presenter successfully exploited the vulnerability using a Metasploit module, achieving a root shell on the target device (running Red Hat 7.7 1908). The CVSS score assigned by HPE's CNA is 10.0 (CRITICAL), though the NVD assessment was awaiting analysis at the time of recording. The exploit works by sending a PUT request to the vulnerable endpoint with a specially crafted JSON payload containing the command to execute. HPE released a security hotfix, and the mitigation guidance advises users to upgrade to version 11.0 or later, or apply the emergency hotfixes. The presenter noted that the vendor's hotfix applied a new HTTP rule to block access to the endpoint, rather than disabling the feature entirely, which he found concerning from a security architecture standpoint.

Context: The video discusses the details and exploitation of CVE-2025-37164, a critical vulnerability discovered in HPE OneView, a privileged control plane management software for enterprise infrastructure. The vulnerability was reported to HPE by security researcher Nguyen Quoc Khanh. The presenter reviews the details from the NIST NVD entry and a Rapid7 blog post, focusing heavily on the technical aspects of the exploit, which was quickly weaponized into a Metasploit module.

Detailed Analysis

The video analyzes CVE-2025-37164, a critical, unauthenticated Remote Code Execution (RCE) vulnerability in HPE OneView, which received a CVSS 3.1 score of 10.0 (CRITICAL) from the CNA (Hewlett Packard Enterprise). The vulnerability is described as a command injection issue existing in HPE OneView. The presenter demonstrates that the Metasploit framework quickly integrated an exploit module for this flaw. The exploit targets the REST API endpoint /rest/id-pools/executeCommand, which accepts a PUT request with a JSON body containing the command to be executed. The presenter successfully executed a command to establish a reverse shell, obtaining a root session on the target system running Red Hat 7.7. The presenter expresses strong disapproval of the vulnerability's simplicity and the implied trust assumptions within the management platform's architecture, especially since management platforms are often deployed deep within the network with high privileges. The Rapid7 analysis noted that the vendor's hotfix applied a new HTTP rule to block access to the endpoint, instead of disabling the underlying functionality, which the presenter views as a weak solution that could easily be bypassed if the architecture is flawed. Mitigation guidance recommends upgrading past version 11.0 or applying the relevant hotfixes.