CVE-2025-37101

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions).

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise	HPE OneView for VMware vCenter	>= Prior to v11.7, < 11.7

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04876en_us&docLocale=en_US

Timeline

Published: Jun 26, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-371027.2An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A succe CVE-2025-371039.8Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal CVE-2025-371047.1A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients CVE-2025-371059.8An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371069.8An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371079.8An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.CVE-2025-371083.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-371093.5Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product CVE-2025-37119.8The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthe CVE-2025-371106.0A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function CVE-2025-371116.0A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orche CVE-2025-371126.0A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestra