Medium severity · published Jul 31, 2025
CVE-2025-37110
Sensitive Credential Information stored insecurely in System Database
6.0
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
HPE Telco Network Function Virtual Orchestrator · Hewlett Packard Enterprise
7.0.0 through 7.3.0 · source: vendor
Affected product
HT
HPE Telco Network Function Virtual Orchestrator
Hewlett Packard Enterprise
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-37110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-37110
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04891en_us
More from HPE Telco Network Function Virtual Orchestrator
6.0
CVE-2025-37112
Hard-Coded Encryption Keys found in System
6.0
CVE-2025-37111
Hard-Coded Authentication Keys found in System