CVE-2025-37096

A command injection remote code execution vulnerability exists in HPE StoreOnce Software

High · published June 2, 2025

CVSS v4.0
7.5
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

⚡ A sneaky command injection vulnerability in HPE StoreOnce could allow attackers to run arbitrary code with just a simple payload! Think of it like a restaurant where a waiter misreads an order and starts cooking whatever the customer whimsically suggests, potentially ruining the entire menu! 🍽️ If exploited, an attacker could gain full control of the system, leading to unauthorized access to sensitive data, disruption of services, or even worse - total server takeover! This could be absolutely devastating for businesses relying on HPE StoreOnce for backup and recovery.

Put simply

Think of it like a restaurant where a waiter misreads an order and starts cooking whatever the customer whimsically suggests, potentially ruining the entire menu! 🍽️ This vulnerability allows remote code execution via crafted commands sent to the HPE StoreOnce system, bypassing normal security checks and giving attackers unauthorized access to execute malicious code.

What to do

If exploited, an attacker could gain full control of the system, leading to unauthorized access to sensitive data, disruption of services, or even worse - total server takeover! This could be absolutely devastating for businesses relying on HPE StoreOnce for backup and recovery. To protect yourself, immediately update HPE StoreOnce Software to the latest version that addresses this vulnerability. Also, monitor your systems for any unusual activity, and consider implementing stricter access controls to limit exposure. You've got this! By taking these steps, you can fortify your defenses and keep your systems secure! 🛡️

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01246 · 69.1th percentile
Published
2025-06-02T14:18Z
EPSS history
Timeline
  • 02 JUN 14:18Z
    A command injection remote code execution vulnerability exists in HPE StoreOnce Software
    cvelistv5