# this is already the worst bug of 2026

Source: https://www.youtube.com/watch?v=0Uu-FMs9qyg
Recap page: https://rapidrecap.app/video/0Uu-FMs9qyg
Generated: 2026-01-05T21:34:03.226+00:00

---
## Quick Overview

The critical vulnerability CVE-2025-37164 in HPE OneView is an unauthenticated Remote Code Execution (RCE) flaw exploitable via a command injection vulnerability in the REST API endpoint /rest/id-pools/executeCommand, which allowed the presenter to gain a root shell on the target system using a Metasploit module.

**Key Points:**
- CVE-2025-37164 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Hewlett Packard Enterprise (HPE) OneView.
- The vulnerability stems from a command injection flaw in the REST API endpoint /rest/id-pools/executeCommand, which was reachable without authentication.
- The presenter successfully exploited the vulnerability using a Metasploit module, achieving a root shell on the target device (running Red Hat 7.7 1908).
- The CVSS score assigned by HPE's CNA is 10.0 (CRITICAL), though the NVD assessment was awaiting analysis at the time of recording.
- The exploit works by sending a PUT request to the vulnerable endpoint with a specially crafted JSON payload containing the command to execute.
- HPE released a security hotfix, and the mitigation guidance advises users to upgrade to version 11.0 or later, or apply the emergency hotfixes.
- The presenter noted that the vendor's hotfix applied a new HTTP rule to block access to the endpoint, rather than disabling the feature entirely, which he found concerning from a security architecture standpoint.

![Screenshot at 00:58: The metrics section showing HPE's CNA assigned a Base Score of 10.0 CRITICAL for CVE-2025-37164, highlighting the severity of the unauthenticated RCE.](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-00-58.jpg)

**Context:** The video discusses the details and exploitation of CVE-2025-37164, a critical vulnerability discovered in HPE OneView, a privileged control plane management software for enterprise infrastructure. The vulnerability was reported to HPE by security researcher Nguyen Quoc Khanh. The presenter reviews the details from the NIST NVD entry and a Rapid7 blog post, focusing heavily on the technical aspects of the exploit, which was quickly weaponized into a Metasploit module.

## Detailed Analysis

The video analyzes CVE-2025-37164, a critical, unauthenticated Remote Code Execution (RCE) vulnerability in HPE OneView, which received a CVSS 3.1 score of 10.0 (CRITICAL) from the CNA (Hewlett Packard Enterprise). The vulnerability is described as a command injection issue existing in HPE OneView. The presenter demonstrates that the Metasploit framework quickly integrated an exploit module for this flaw. The exploit targets the REST API endpoint /rest/id-pools/executeCommand, which accepts a PUT request with a JSON body containing the command to be executed. The presenter successfully executed a command to establish a reverse shell, obtaining a root session on the target system running Red Hat 7.7. The presenter expresses strong disapproval of the vulnerability's simplicity and the implied trust assumptions within the management platform's architecture, especially since management platforms are often deployed deep within the network with high privileges. The Rapid7 analysis noted that the vendor's hotfix applied a new HTTP rule to block access to the endpoint, instead of disabling the underlying functionality, which the presenter views as a weak solution that could easily be bypassed if the architecture is flawed. Mitigation guidance recommends upgrading past version 11.0 or applying the relevant hotfixes.

### Vulnerability Details

- CVE-2025-37164 identified a remote code execution issue in HPE OneView
- The vulnerability allows unauthenticated command injection via the /rest/id-pools/executeCommand endpoint using a PUT request
- HPE CNA assigned a CVSS 3.1 score of 10.0 (CRITICAL)

### Exploitation Walkthrough

- The presenter uses a Metasploit module to exploit the vulnerability
- The exploit sends a payload using the execute command function within the JSON data structure
- Successful exploitation results in a Meterpreter session running as root

### Hotfix Analysis

- Rapid7 noted the vendor's hotfix applies a new HTTP rule to block access to the specific REST API endpoint
- The presenter is critical that the fix is a block rather than a fundamental code change, implying the vulnerability is inherently present

### Context and Implication

- The vulnerability is severe because OneView is a privileged control plane for enterprise infrastructure, meaning exploitation provides deep network access
- The risk is compounded by the expectation that these management platforms are trusted implicitly within the network

![Screenshot at 00:00: CVE-2025-37164 detail page showing the vulnerability is 'AWAITING ANALYSIS' from NVD but noting a remote code execution issue in HPE OneView.](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-00-00.jpg)
![Screenshot at 00:58: The CVSS metrics showing the base score of 10.0 CRITICAL assigned by the CNA \(Hewlett Packard Enterprise\).](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-00-58.jpg)
![Screenshot at 01:24: A snippet of the Metasploit Ruby module code showing the definition of the execute command function which handles sending the shell command payload.](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-01-24.jpg)
![Screenshot at 01:37: The Metasploit module code detailing the structure of the exploit, including payload options like RadChars and encoder usage.](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-01-37.jpg)
![Screenshot at 02:58: The terminal output confirming a successful Metasploit execution, showing the established Meterpreter session running as user 'root'.](https://ss.rapidrecap.app/screens/0Uu-FMs9qyg/00-02-58.jpg)