Target Industry
Indiscriminate, opportunistic targeting.
Overview
Hewlett Packard Enterprise (HPE) has issued a security advisory regarding a critical authentication bypass vulnerability in its StoreOnce data backup and deduplication platform, tracked as CVE-2025-37093. This vulnerability has a CVSS score of 9.8, indicating a critical risk level. The vulnerability allows unauthenticated threat actors to bypass authentication mechanisms, potentially leading to unauthorised access to sensitive data.
Impact
The impact of CVE-2025-37093 is significant, as it allows threat actors to gain full system access without authentication. This can lead to remote code execution, data breaches, and potential ransomware deployment. The financial implications could be severe, including costs associated with data recovery, legal liabilities, and reputational damage.
Affected Products
HPE StoreOnce VSA – Prior to v4.3.11
Exploitation
The CVE-2025-37093 vulnerability in HPE StoreOnce is exploited through an improper implementation of an authentication algorithm in the machineAccountCheck method. Once authenticated, threat actors can chain this vulnerability with other vulnerabilities to achieve remote code execution, information disclosure, and arbitrary file deletion.
Containment, Mitigations & Remediations
To mitigate the risks associated with CVE-2025-37093, organisations should promptly upgrade to the latest software version, which includes patches for this vulnerability and for the vulnerabilities listed below:
- CVE-2025-37089 – Remote Code Execution
- CVE-2025-37090 – Server-Side Request Forgery
- CVE-2025-37091 – Remote Code Execution
- CVE-2025-37092 – Remote Code Execution
- CVE-2025-37093 – Authentication Bypass
- CVE-2025-37094 – Directory Traversal Arbitrary File Deletion
- CVE-2025-37095 – Directory Traversal Information Disclosure
- CVE-2025-37096 – Remote Code Execution.
It is also advisable to isolate vulnerable systems from external networks until they can be patched. Implementing network segmentation and Zero Trust principles can further reduce exposure. Regularly updating asset inventories and monitoring logs for unauthorised access attempts is also recommended.
Threat Landscape
The threat landscape surrounding this vulnerability is characterised by increasing attacks on backup infrastructure, as threat actors recognise the critical role these systems play in organisational resilience. The motivations behind these attacks often include financial gain through ransomware or data theft.
Threat Group
While specific threat groups have not been directly linked to the exploitation of CVE-2025-37093, the nature of the vulnerability makes it attractive to various cybercriminals, including ransomware groups and advanced persistent threat (APT) actors. These groups often exploit vulnerabilities in backup systems to gain deeper access to networks.
Further Information
