New botnet reportedly targets HPE OneView, so be on your guard

• Critical HPE OneView RCE flaw (CVE-2025-37164) could be exploited despite patch release
• Over 40,000 botnet-driven attacks observed, mainly from RondoDox targeting key sectors
• CPR and CISA urge immediate patching due to active, high-severity exploitation

Cybersecurity experts at Check Point Research (CPR) are urging HPE OneView users to ensure they are fully patched after discovering a remote code execution (RCE) vulnerability which could allow threat actors to run malware on underlying operating systems if exploited.

HPE OneView is a unified IT infrastructure management platform that automates provisioning and lifecycle management using software-defined templates.

"HPE has not received reports directly from customers of the vulnerability being exploited," the company told us in a statement. "This vulnerability can only be exploited if the threat actor has local access to a user's network, and we encourage our customers to ensure they are using best security practices in their network environment. A hotfix was released for this vulnerability on 12/17/25, with an enhanced version released on 1/15/26."

Real-world risk

The bug is now tracked as CVE-2025-37164 and was given a severity score of 9.8/10 (critical).

On December 21 2025, HPE released a patch, and saw first exploitation attempts that same night. At first, these attempts were nothing more than probing and reconnaissance, as cybercriminals tested the waters to see if the bug can really be abused, how, and to what extent.

A few weeks later, starting on January 7, researchers from CPR observed “a dramatic escalation”, recording more than 40,000 attack attempts in less than four hours. The attempts were automated, botnet-driven, and attributed to the RondoDox botnet.

This is a relatively new, Linux-based botnet that does all the usual things - facilitates Distributed Denial of Service (DDoS) attacks and cryptomining.

Most of the activity comes from a single IP address in the Netherlands, CPR said, stressing that the IP address was “widely reported” as suspicious. RondoDox primarily targets government organizations, but also financial services firms and those in the industrial manufacturing sector. The majority of the victims are located in the United States, followed by Australia, France, Germany, and Austria.

All things considered, CPR says businesses should expedite patching: “Organizations running HPE OneView should patch immediately and ensure compensating controls are in place,” it said in a security advisory.

In the meantime, the US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its catalog of known exploited flaws (KEV) which, CPR further stressed, “reinforces the urgency”.

“This vulnerability is actively exploited and presents a real-world risk.”

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.