# MA-1350.062025: MyCERT Advisory - Privilege Escalation Vulnerability in HPE OneView for VMware vCenter

**Date:** 30 Jun 2025  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1350.062025  
**Advisory ID:** MA-1350.062025

---

**1.0 Introduction**
Recently, Hewlett Packard Enterprise released a security bulletin for local privilege escalation vulnerability in HPE OneView for VMware vCenter **( CVE-2025-37101 )**.
**2.0 Impact**
This vulnerability allows a read-only user to escalate privileges and execute administrative actions, posing a significant risk in multi-user and virtualized environments.
**3.0 Affected Products**
- **CVE-2025-37101 (High)**- HPE OneView for VMware vCenter (OV4VC) versions prior to v11.7
**4.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review the following  [Hewlett Packard Enterprise Security Bulletin](https://support.hpe.com/connect/s/securitybulletinlibrary?language=en_US) and apply the latest update:
Kindly, please refer to the URL below for latest update :
- <https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04876en_us&docLocale=en_US>
Generally, CyberSecurity Malaysia advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.cybersecurity.my>
**5.0    References**
- <https://support.hpe.com/connect/s/securitybulletinlibrary?language=en_US>
- <https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04876en_us&docLocale=en_US>
- <https://www.cve.org/CVERecord?id=CVE-2025-37101>