CVE-2025-37091: HPE StoreOnce System RCE Vulnerability

CVE-2025-37091 Overview

A command injection remote code execution vulnerability exists in HPE StoreOnce Software. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected HPE StoreOnce backup systems through specially crafted requests, potentially compromising enterprise backup infrastructure and sensitive data.

Critical Impact

This command injection vulnerability enables remote attackers to execute arbitrary system commands without authentication, potentially leading to complete system compromise, data exfiltration, ransomware deployment, or disruption of critical backup operations.

Affected Products

• HPE StoreOnce System (all vulnerable versions)
• HPE StoreOnce Backup Appliances
• HPE StoreOnce Software deployments

Discovery Timeline

• 2025-06-02 - CVE-2025-37091 published to NVD
• 2025-07-02 - Last updated in NVD database

Technical Details for CVE-2025-37091

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as Command Injection. HPE StoreOnce Software fails to properly sanitize user-supplied input before incorporating it into system commands. This allows an attacker to inject malicious commands that are executed with the privileges of the application, potentially granting full control over the backup appliance.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it particularly dangerous in enterprise environments where StoreOnce systems are deployed as critical backup infrastructure. Successful exploitation could allow attackers to access, modify, or delete backup data, pivot to other systems on the network, or install persistent backdoors.

Root Cause

The root cause stems from improper input validation and command construction within the HPE StoreOnce Software. User-controllable input is passed directly or indirectly to system shell commands without adequate sanitization or escaping of special characters. This allows metacharacters such as semicolons, pipes, backticks, or command substitution sequences to break out of the intended command context and execute attacker-controlled commands.

Attack Vector

This vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. An attacker with network access to the HPE StoreOnce management interface can craft malicious HTTP requests containing command injection payloads. These payloads are processed by the vulnerable application component, which passes the unsanitized input to the underlying operating system shell for execution.

The attack surface includes network-exposed management interfaces commonly used for administration and monitoring of StoreOnce backup appliances. Organizations exposing these interfaces to untrusted networks face elevated risk of exploitation.

For detailed technical information about this vulnerability and exploitation mechanics, refer to the HPE Security Advisory.

Detection Methods for CVE-2025-37091

Indicators of Compromise

• Unusual outbound network connections from StoreOnce systems to unknown external IP addresses
• Unexpected processes or services running on the StoreOnce appliance
• Suspicious entries in system logs indicating command execution with unusual parameters or shell metacharacters
• Authentication or access anomalies in StoreOnce management interface logs
• Unexplained modifications to system configurations or backup job settings

Detection Strategies

• Monitor HTTP/HTTPS traffic to StoreOnce management interfaces for requests containing shell metacharacters or command injection patterns
• Implement network-based intrusion detection rules to identify command injection attempts targeting StoreOnce systems
• Deploy endpoint detection and response (EDR) solutions capable of monitoring process creation and command-line arguments on StoreOnce appliances
• Enable verbose logging on StoreOnce systems and forward logs to a centralized SIEM for analysis

Monitoring Recommendations

• Establish baseline behavior for StoreOnce systems and alert on deviations in network connections, process activity, or resource utilization
• Configure alerts for any remote shell access or unexpected administrative commands executed on StoreOnce appliances
• Monitor for file system changes in critical directories and configuration files
• Implement network segmentation monitoring to detect lateral movement attempts originating from compromised backup infrastructure

How to Mitigate CVE-2025-37091

Immediate Actions Required

• Apply the security patch provided by HPE immediately to all affected StoreOnce systems
• Restrict network access to StoreOnce management interfaces using firewall rules and network segmentation
• Ensure StoreOnce systems are not directly exposed to the internet or untrusted networks
• Review system and application logs for any indicators of prior exploitation attempts
• Implement additional monitoring on StoreOnce systems until patching is complete

Patch Information

HPE has released a security advisory addressing this vulnerability. Administrators should consult the HPE Security Advisory (hpesbst04847en_us) for detailed patching instructions, affected version information, and updated software downloads. Apply the vendor-provided patches following your organization's change management procedures, prioritizing production backup systems.

Workarounds

• Implement strict network access controls to limit connectivity to StoreOnce management interfaces to authorized administrator IP addresses only
• Deploy a web application firewall (WAF) or reverse proxy with input validation rules to filter potentially malicious requests
• Enable multi-factor authentication for all administrative access to StoreOnce systems where supported
• Consider temporarily disabling non-essential network services on StoreOnce appliances until patches can be applied
• Implement network microsegmentation to isolate backup infrastructure from general network traffic

# Example firewall rule to restrict StoreOnce management access
# Allow only authorized admin subnet to access management interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP