CVE-2025-37104

HIGH EPSS 9.5%

Published Jul 16, 202511mo ago · Modified Jun 17, 20262w ago

7.1 CVSS 3.1

High

Published Jul 16, 2025 11mo ago

Last Modified Jun 17, 2026 2w ago

Description

A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated clients.

CVSS Details

Base Score

7.1

Exploitability

1.3

Impact

5.3

Vector string

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

Attack Vector Adjacent

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality Low

Integrity High

Availability Low

Threat Intelligence

EPSS Exploit Probability

9.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

References 1

support.hpe.com https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04875en_us&docLocale=en_US

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.