What is the CVSS score of EUVD-2025-16655?

EUVD-2025-16655 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Storeonce System are affected by EUVD-2025-16655?

CVE-2025-37091 is a high-severity command injection vulnerability in HPE StoreOnce Software that allows authenticated administrators to execute arbitrary commands on backup infrastructure.. A patch is available.

How to fix or mitigate EUVD-2025-16655?

Within 24 hours: Identify all HPE StoreOnce deployments and document current software versions in use. Within 7 days: Apply vendor-released patch to all affected StoreOnce instances and verify successful deployment. Within 30 days: Conduct access reviews of StoreOnce administrative accounts and implement privileged access management (PAM) controls if not already in place.

Storeonce System EUVD-2025-16655

| CVE-2025-37091 HIGH

Command Injection (CWE-77)

2025-06-02 security-alert@hpe.com

RCE Command Injection HP Storeonce System

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.3.11

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16655

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 14:15 nvd

HIGH 7.2

DescriptionNVD

A command injection remote code execution vulnerability exists in HPE StoreOnce Software.

AnalysisAI

Command injection remote code execution vulnerability in HPE StoreOnce Software that allows authenticated attackers with high privileges to execute arbitrary commands on affected systems. The vulnerability has a CVSS score of 7.2 (high severity) and requires authenticated access but no user interaction. Given the command injection nature (CWE-77) and network attack vector, this poses significant risk to organizations running vulnerable HPE StoreOnce deployments, particularly if KEV status or active exploitation is confirmed.

Technical ContextAI

The vulnerability exploits improper input validation in HPE StoreOnce Software, a backup and deduplication appliance platform widely deployed in enterprise environments. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the application fails to properly sanitize user-supplied input before passing it to system command execution functions. This is a classic command injection flaw where special shell metacharacters or command separators are not filtered, allowing attackers to break out of intended command boundaries and execute arbitrary operating system commands. HPE StoreOnce runs on dedicated appliance hardware and manages critical backup infrastructure, making command execution access particularly dangerous.

RemediationAI

Immediate: Restrict network access to HPE StoreOnce management interfaces (typically port 443, 22) to trusted administrative networks using firewall rules; enforce strong multi-factor authentication on all backup administrator accounts. 2) Patch: Apply HPE Security Update for StoreOnce—refer to HPE Security Advisory HPE-SB-xxx-xxx (specific bulletin number to be confirmed) for exact patch versions and download links. 3) Workarounds (if patching delayed): Disable remote management access if not required; implement IP whitelisting; rotate high-privilege credentials and audit recent access logs. 4) Monitoring: Enable command/audit logging on StoreOnce appliances to detect suspicious command execution patterns; monitor authentication logs for unauthorized admin access attempts.