PT-2025-29874 · Hewlett Packard · Hpe Autopass License Server

Published 2025-07-16 · Updated 2025-07-17 · CVE-2025-37106

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE AutoPass License Server (APLS) versions prior to 9.18

Description An authentication bypass and information disclosure issue exists in HPE AutoPass License Server (APLS). This allows unauthorized access and potential exposure of sensitive information.

Recommendations Update HPE AutoPass License Server (APLS) to version 9.18 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-37106

ZDI-25-613

Affected Products

Hpe Autopass License Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-37106 · Security Note
• https://osv.dev/vulnerability/CVE-2025-37106 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-613 · Security Note
• https://t.me/cvetracker/27996 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04877en_us · Note
• https://twitter.com/CVEnew/status/1945562933481652415 · Twitter Post