rxerium/CVE-2025-37164

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects potentially vulnerable HPE OneView instances by checking for the OneView title tag, extracting the version, and flagging versions below 11.00. It does not exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Nuclei template (CVE-2025-37164.yaml) and a README.md file. The template performs a benign GET request to the target, extracts a version string from the response body, and uses a DSL matcher to compare the version against '<11.00'. No malicious, deceptive, or concealed executable behavior is present. The README provides usage instructions and contact information, none of which constitutes a backdoor or trojan.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagesyaml
Target softwareHPE OneView
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version detection and comparison to identify potentially vulnerable instances. It does not contain any code to execute commands, inject code, or otherwise exploit the vulnerability. The README explicitly states it is a 'vulnerability detection script' and warns that flagged instances are only 'possibly vulnerable'.

CVE-2025-37164.yaml:1-56README.md:7-9

Requirements

  • Target must be running HPE OneView and respond to HTTP GET requests.CVE-2025-37164.yaml:26-28

Observed behavior

  • Sends an HTTP GET request to the target base URL.CVE-2025-37164.yaml:26-28
  • Extracts the version string from the JavaScript variable 'artifactVersion' in the response body.CVE-2025-37164.yaml:30-37
  • Matches if the HTTP status is 200, the response body contains '<title>OneView', and the extracted version is less than 11.00.CVE-2025-37164.yaml:43-56
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-37164.yamlThe template sends a single GET request to the target, extracts a version via regex, and compares it to '<11.00' using a DSL matcher. This is standard vulnerability detection behavior.CVE-2025-37164.yaml:25-56
Contact Information
Signal and Twitter/X links in README.mdThe README includes contact links for the author. These are standard for open-source projects and do not indicate backdoor behavior.README.md:50-52
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the text content; it is unlikely to contain exploit code.
  • The evidence does not include the actual execution of the template, only its static definition.
  • One file (likely an image) was omitted from text analysis and is flagged as metadata-only; its content was not inspected.
  • The review is limited to the supplied evidence and does not verify the safety of external dependencies (e.g., Nuclei itself) or the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1