Hewlett Packard Enterprise (HPE) addressed multiple flaws in its StoreOnce data backup and deduplication solution.
HPE has released security patches for eight vulnerabilities in its StoreOnce backup solution. These issues could allow remote code execution, authentication bypass, data leaks, and more.
“Potential security vulnerabilities have been identified in HPE StoreOnce Software.” reads the advisory. “These vulnerabilities could be remotely exploited to allow remote code execution, disclosure of information, server-side request forgery, authentication bypass, arbitrary file deletion, and directory traversal information disclosure vulnerabilities.”
Below is the list of the flaws addressed by the company:
- CVE-2025-37089 – ZDI-CAN-24981 Remote Code Execution
- CVE-2025-37090 – ZDI-CAN-24982 Server-Side Request Forgery
- CVE-2025-37091 – ZDI-CAN-24983 Remote Code Execution
- CVE-2025-37092 – ZDI-CAN-24984 Remote Code Execution
- CVE-2025-37093 – ZDI-CAN-24985 Authentication Bypass
- CVE-2025-37094 – ZDI-CAN-25314 Directory Traversal Arbitrary File Deletion
- CVE-2025-37095 – ZDI-CAN-25315 Directory Traversal Information Disclosure
- CVE-2025-37096 – ZDI-CAN-25316 Remote Code Execution
The most severe vulnerability is an Authentication Bypass issue tracked as CVE-2025-37093 (CVSS score of 9,8). The flaw impacts all versions prior to 4.3.11.
“An authentication bypass vulnerability exists in HPE StoreOnce Software.” reads the advisory published by NIST.
The CVE-2025-37093 can be chained with the remaining flaws addressed by HPE to achieve remote code execution.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Hewlett Packard Enterprise)
