Published On: Jun 16, 2025 08:57
Advisory No: TZCERT-SA-25-0099
Source: HP
Software Affected: HPE Telco Service Orchestrator, HPE OneView, HPE Insight Remote Support (IRS), HPE StoreOnce Software, HP ThinPro
Five HPE products are affected by critical vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute remote code.
HPE Telco Service Orchestrator, HPE OneView, HPE Insight Remote Support (IRS), HPE StoreOnce Software, and HP ThinPro are affected by vulnerabilities tracked as CVE-2025-31651, CVE-2024-38476, CVE-2025-37099, CVE-2025-37093, and CVE-2024-5171 with CVSS scores of 9.8 and 10. The vulnerabilities result from Improper Neutralization of Escape, Meta, or Control Sequences vulnerability, backend applications whose response headers are malicious, a lack of proper validation of a user-supplied path before using it in file operations, improper handling of an authentication algorithm, and an Integer overflow in libaom internal function img_alloc_helper. The vulnerabilities allow a remote attacker to cause a denial of service, code execution, or source code disclosure, information disclosure, server-side request forgery (SSRF), and local script execution on the affected device.
Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.
HP has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.
A digest of Tanzania Computer Emergency Response Team coverage of cyber-security news across the globe.
