Do Son RondoDox botnet targets HPE OneView with 40k attacks in 4 hours. Critical RCE CVE-2025-37164 allows full system takeover. Patch immediately.
HPE OneView
CISA adds critical HPE OneView (CVE-2025-37164) and legacy PowerPoint (CVE-2009-0556) flaws to KEV. FCEB agencies must patch by Jan 28, 2026.
A maximum-severity HPE OneView flaw (CVE-2025-37164) bypasses auth to execute code via the ID Pools API. Upgrade to v11.00 or apply hotfixes now.
With a CVSS score of 9.8, CVE-2023-30908 allows an attacker to bypass authentication and gain unauthorized access to HPE OneView