CVE-2025-37099

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and indicates the possibility of code injection or manipulation of code executed by the application. An attacker can send specially crafted requests to the IRS system without the need for authentication, which leads to arbitrary code execution on the server side. The network vector (AV:N) with no privilege requirements (PR:N) and user interaction (UI:N) means full remote exploitation.

Successful exploitation allows an attacker to gain full system control — violation of confidentiality, integrity, and availability of data and services. The attacker can gain unauthorized access to sensitive information managed by IRS, modify configuration, or completely disable the service.

HPE Insight Remote Support must be immediately updated to version v7.15.0.646 or later. Detailed update instructions are available in the official HPE security bulletin at: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US

HPE Insight Remote Support (IRS) in all versions earlier than v7.15.0.646