HPE OneView RCE (CVE-2025-37164)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(282316);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/07");

  script_cve_id("CVE-2025-37164");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/01/28");

  script_name(english:"HPE OneView RCE (CVE-2025-37164)");

  script_set_attribute(attribute:"synopsis", value:
"An integrated IT infrastructure management software is affected by an
authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote HPE OneView appliance is affected by an remote code execution vulnerability. An unauthenticated, remote 
attacker can exploit this.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.");
  # https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?165c11af");
  script_set_attribute(attribute:"solution", value:
"Apply updates in accordance with the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-37164");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'HPE OneView unauthenticated RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:hpe:oneview");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("hpe_oneview_detect.nbin");
  script_require_keys("installed_sw/HPE OneView", "Settings/ParanoidReport");

  exit(0);
}
include('vcf.inc');

# Due to the hotfix and the lack of easy ability to confirm that it has been setup correctly, 
# this check is currently paranoid for now.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::combined_get_app_info(app:'HPE OneView');

var constraints = [
  { 'fixed_version' : '11.0.0', 'fixed_display':'11.0 or Hotfix HPE_OneView_CVE_37164_Z7550-98077' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);