Pierluigi Paganini
June 04, 2025
HPE has released security patches for eight vulnerabilities in its StoreOnce backup solution. These issues could allow remote code execution, authentication bypass, data leaks, and more.
“Potential security vulnerabilities have been identified in HPE StoreOnce Software.” reads the advisory. “These vulnerabilities could be remotely exploited to allow remote code execution, disclosure of information, server-side request forgery, authentication bypass, arbitrary file deletion, and directory traversal information disclosure vulnerabilities.”
Below is the list of the flaws addressed by the company:
The most severe vulnerability is an Authentication Bypass issue tracked as CVE-2025-37093 (CVSS score of 9,8). The flaw impacts all versions prior to 4.3.11.
“An authentication bypass vulnerability exists in HPE StoreOnce Software.” reads the advisory published by NIST.
The CVE-2025-37093 can be chained with the remaining flaws addressed by HPE to achieve remote code execution.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Hewlett Packard Enterprise)
