Listen to this Post
How the CVE Works
CVE-2025-37105 is a critical remote code execution (RCE) vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.18, stemming from insecure deserialization in the embedded HSQLDB component. Attackers can exploit this flaw by sending a maliciously crafted serialized object to the APLS service, which then deserializes it without proper validation. This allows arbitrary code execution under the context of the APLS service account, potentially leading to full system compromise. The exploit leverages default configurations where HSQLDB’s network listener is enabled, exposing the service to unauthenticated remote attacks.
DailyCVE Form
Platform: HPE AutoPass License Server
Version: < 9.18
Vulnerability: Remote Code Execution
Severity: Critical
Date: 07/25/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Analytics:
nmap -p 9001 --script hsqldb-exploit <target_IP> curl -X POST --data-binary @malicious.ser http://<target_IP>:9001/hsqldb
Exploit:
- Craft malicious serialized payload using
ysoserial. - Send payload to APLS HSQLDB listener (default port 9001).
- Trigger deserialization for RCE.
Protection from this CVE:
- Upgrade to APLS 9.18 or later.
- Disable HSQLDB network listener if unused.
- Apply network segmentation to restrict APLS access.
Impact:
- Full system compromise via RCE.
- Unauthorized license manipulation.
- Data exfiltration.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
