{"id":"CVE-2025-37101","state":"PUBLISHED","title":"HPE OneView for VMware vCenter (OV4VC), Local Elevation of Privilege","description":"A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions).","publishedAt":"2025-06-26T05:19:02.298Z","updatedAt":"2026-02-26T17:50:23.327Z","severity":{"score":8.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","source":"hpe"},"assigner":"hpe","products":["Hewlett Packard Enterprise HPE OneView for VMware vCenter"],"affected":[{"vendor":"Hewlett Packard Enterprise","product":"HPE OneView for VMware vCenter","defaultStatus":"affected","versions":[{"version":"Prior to v11.7","status":"affected","lessThan":"11.7","versionType":"v11.7"}],"platforms":["Windows","Linux"]}],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04876en_us&docLocale=en_US"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/37xxx/CVE-2025-37101.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-37101","state":"PUBLISHED","datePublished":"2025-06-26T05:19:02.298Z","dateUpdated":"2026-02-26T17:50:23.327Z","assignerShortName":"hpe","assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateReserved":"2025-04-16T01:28:25.364Z"},"containers":{"cna":{"title":"HPE OneView for VMware vCenter (OV4VC), Local Elevation of Privilege","descriptions":[{"lang":"en","value":"A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions)."}],"affected":[{"vendor":"Hewlett Packard Enterprise","product":"HPE OneView for VMware vCenter","defaultStatus":"affected","versions":[{"version":"Prior to v11.7","status":"affected","lessThan":"11.7","versionType":"v11.7"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04876en_us&docLocale=en_US"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"hpe","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateUpdated":"2025-06-26T05:19:02.298Z"},"datePublic":"2025-06-24T10:16:00.000Z","impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-37101","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-06-27T03:55:25.332378Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T17:50:23.327Z"}}]}}}