EUVD-2025-16655
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
Analysis
Command injection remote code execution vulnerability in HPE StoreOnce Software that allows authenticated attackers with high privileges to execute arbitrary commands on affected systems. The vulnerability has a CVSS score of 7.2 (high severity) and requires authenticated access but no user interaction. Given the command injection nature (CWE-77) and network attack vector, this poses significant risk to organizations running vulnerable HPE StoreOnce deployments, particularly if KEV status or active exploitation is confirmed.
Technical Context
The vulnerability exploits improper input validation in HPE StoreOnce Software, a backup and deduplication appliance platform widely deployed in enterprise environments. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the application fails to properly sanitize user-supplied input before passing it to system command execution functions. This is a classic command injection flaw where special shell metacharacters or command separators are not filtered, allowing attackers to break out of intended command boundaries and execute arbitrary operating system commands. HPE StoreOnce runs on dedicated appliance hardware and manages critical backup infrastructure, making command execution access particularly dangerous.
Affected Products
HPE StoreOnce Software (specific version range not provided in available data; typically includes StoreOnce appliances running affected OS/application versions). Affected CPE strings likely include: cpe:2.3:a:hp:storeonce:*:*:*:*:*:*:*:* (version range to be determined from HPE advisory). Specific product lines include: HPE StoreOnce Backup, HPE StoreOnce Catalyst, and HPE StoreOnce Replication appliances. Organizations should consult HPE Security Advisory for exact version ranges (e.g., all versions before 5.x.x, or specific 5.x branches). Refer to HPE Security Bulletin for definitive CPE and version data.
Remediation
1) **Immediate**: Restrict network access to HPE StoreOnce management interfaces (typically port 443, 22) to trusted administrative networks using firewall rules; enforce strong multi-factor authentication on all backup administrator accounts. 2) **Patch**: Apply HPE Security Update for StoreOnce—refer to HPE Security Advisory HPE-SB-xxx-xxx (specific bulletin number to be confirmed) for exact patch versions and download links. 3) **Workarounds** (if patching delayed): Disable remote management access if not required; implement IP whitelisting; rotate high-privilege credentials and audit recent access logs. 4) **Monitoring**: Enable command/audit logging on StoreOnce appliances to detect suspicious command execution patterns; monitor authentication logs for unauthorized admin access attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today