Hewlett Packard Enterprise (HPE) Vulnerabilities and Affected Products
Vulnerabilities associated with HPE OneView.
Products
Clear product- Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central51 vulnerabilities
- ArubaOS (AOS)34 vulnerabilities
- Aruba ClearPass Policy Manager33 vulnerabilities
- EdgeConnect SD-WAN Orchestrator27 vulnerabilities
- HPE Aruba Networking Wireless Operating System (AOS)27 vulnerabilities
- Aruba EdgeConnect Enterprise Software23 vulnerabilities
- AOS-8 Instant and AOS-10 AP18 vulnerabilities
- Aruba Access Points running InstantOS and ArubaOS 1016 vulnerabilities
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;14 vulnerabilities
- Aruba EdgeConnect Enterprise Orchestration Software13 vulnerabilities
- AOS-CX12 vulnerabilities
- HPE OneView11 vulnerabilities
- HPE Aruba Networking ClearPass Policy Manager10 vulnerabilities
- HPE Aruba Networking EdgeConnect SD-WAN Gateway9 vulnerabilities
- HPE Athonet Core8 vulnerabilities
- HPE StoreOnce Software8 vulnerabilities
- ArubaOS Wi-Fi Controllers and Campus/Remote Access Points7 vulnerabilities
- HPE 3PAR Service Processor7 vulnerabilities
- Aruba OS6 vulnerabilities
- HPE 3PAR StoreServ Management and Core Software Media6 vulnerabilities
- HPE Aruba Networking Access Points, Instant AOS-8, and AOS-106 vulnerabilities
- HPE Aruba Networking AOS6 vulnerabilities
- HPE Aruba Networking AOS-CX5 vulnerabilities
- HPE Aruba Networking EdgeConnect SD-WAN5 vulnerabilities
- HPE Aruba Networking Fabric Composer (AFC)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-37164CRITICAL | Hewlett Packard Enterprise (HPE) OneView Code Injection VulnerabilityA remote code execution issue exists in HPE OneView. | CVSS10.0v3.1 | EPSS90.2% | PoCs4 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-42508MEDIUM | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. CWE-200Oct 18, 2024 | CVSS5.5v3.1 | EPSS0.162% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30912HIGH | A remote code execution issue exists in HPE OneView. CWE-94Oct 25, 2023 | CVSS7.2v3.1 | EPSS1.24% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30909CRITICAL | A remote authentication bypass issue exists in some OneView APIs. | CVSS9.8v3.1 | EPSS1.07% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30908CRITICAL | A remote authentication bypass issue exists in a OneView API. Sep 7, 2023 | CVSS9.8v3.1 | EPSS1.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28090MEDIUM | An HPE OneView appliance dump may expose SNMPv3 read credentials CWE-522Apr 25, 2023 | CVSS5.5v3.1 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28089HIGH | An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules CWE-522Apr 25, 2023 | CVSS7.1v3.1 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28088HIGH | An HPE OneView appliance dump may expose SAN switch administrative credentials CWE-522Apr 25, 2023 | CVSS7.8v3.1 | EPSS0.172% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28087MEDIUM | An HPE OneView appliance dump may expose OneView user accounts CWE-522Apr 25, 2023 | CVSS5.5v3.1 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28086MEDIUM | An HPE OneView appliance dump may expose proxy credential settings CWE-522Apr 25, 2023 | CVSS5.5v3.1 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-28091MEDIUM | HPE OneView virtual appliance "Migrate server hardware" option may expose sensitive information in an HPE OneView support dump Apr 14, 2023 | CVSS5.5v3.1 | EPSS0.192% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |