RondoDox Botnet Targets HPE OneView Vulnerability in Exploitation Wave
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-37164 | Unauthenticated Remote Code Execution in HPE OneView HPE OneView, HPE's infrastructure management platform, contains a code-injection flaw (CWE-94) that permits unauthenticated remote code execution, with a network-vector, low-complexity CVSS 3.1 score of 9.8 meaning no credentials, privileges, or user interaction are required. An attacker triggers the flaw by sending crafted code-injection input to the OneView appliance over the network, gaining code execution with high impact on the confidentiality, integrity, and availability of the appliance. A compromised OneView instance can serve as a foothold into the HPE server estate it manages, and the RondoDox botnet has already been observed folding this flaw into its exploitation waves. Any organization running an HPE OneView appliance is affected, particularly where the appliance is reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-07, a public Metasploit exploit module is available, and EPSS assigns a 90.2% probability of exploitation within 30 days (100th percentile). Do: Upgrade OneView to the fixed release specified in the HPE security bulletin for CVE-2025-37164 (exact version numbers are not included in this data), and treat patching as urgent given confirmed in-the-wild exploitation and the public Metasploit module. Until patched, remove unnecessary internet exposure of the OneView appliance and review appliance and network logs for signs of compromise, including possible RondoDox botnet infection. US federal agencies must apply mitigations per vendor instructions and BOD 22-01 guidance, or discontinue use of the product if mitigations are unavailable. | 9.8 | 90% | KEV PoC |
| large≈ tens of thousands of deployed OneView appliance instances worldwide, with the internet-exposed subset likely in the thousands | |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell. Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials. | 10.0 | 100% | KEV ransomware PoC ×7 |
| mass≈1M+ internet-facing Next.js/React Server Components deployments (order-of-magnitude estimate) |
Full article430 words · extracted from infosecurity-magazine.com · click to collapse
An active, coordinated exploitation campaign conducted by a botnet has been identified by Check Point Research which is targeting a critical vulnerability affecting HPE OneView.
The activity has been attributed to the Linux-based RondoDox botnet and Check Point warned the campaign represents a sharp escalation from early probing attempts to large-scale, automated attacks.
The HPE OneView vulnerability, CVE-2025-37164, was first published to the National Vulnerability Database (NVD) on 16 December, 2025 and was given a CVSS 3.1 score of 10 (critical) by HPE.
In an update published on 15 January, Check Point said it has already blocked tens of thousands of exploitation attempts, underscoring both the severity of the vulnerability and the urgency for organizations to act.
After detecting early exploitation activity and deploying protection measures against the vulnerability in December 2025, Check Point observed a dramatic increase in active exploitation in January 2026.
On 7 January, between 05:45 and 09:20 UTC, the firm recorded more than 40,000 attack attempts exploiting CVE-2025-37164.
“Analysis indicates that these attempts were automated, botnet-driven exploitation,” Check Point said.
RondoDox was first publicly identified in mid-2025, and Check Point said it has observed it actively exploiting high-profile vulnerabilities, including December’s React2Shell CVE-2025-55182, with a particular focus on unpatched edge and perimeter infrastructure.
Check Point Research reported the campaign to CISA the same day, and the vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog the same day.
The HPE OneView is an IT infrastructure management platform that automates the management of computation, storage, and networking resources, which is widely used by organizations across various sectors.
The critical RCE vulnerability resides in the exposed ExecuteCommand REST API endpoint tied to the id-pools functionality.
The endpoint accepts attacker supplied input without authentication or authorization checks and executes it directly via the underlying operating system runtime, without authentication or authorization checks.
This provides attackers with a direct path to remote code execution on affected systems.
“Organizations running HPE OneView should patch immediately and ensure compensating controls are in place. The inclusion of CVE-2025-37164 in CISA’s KEV catalog reinforces the urgency. This vulnerability is actively exploited and presents a real-world risk,” Check Point said.
Update 21 January 2021, HPE sent Infosecurity the following statement:
"HPE has not received reports directly from customers of the vulnerability being exploited. "This vulnerability can only be exploited if the threat actor has local access to a user's network, and we encourage our customers to ensure they are using best security practices in their network environment. A hotfix was released for this vulnerability on 12/17/25, with an enhanced version released on 1/15/26."
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/rondodox-botnet-targets-hpe/