A recently disclosed vulnerability in the OneView program from Hewlett Packard Enterprise (HPE) has become the subject of a botnet attack. The malicious campaign targets IoT devices and web servers running the software-defined infrastructure management platform.

Security firm Check Point claimed to have blocked more than 40,000 attack attempts from the RondoDox botnet, a Linux-based exploit first discovered last year with a modus operandi defined by distributed denial of service (DDoS) and cryptocurrency mining. The current attack wave takes advantage of a remote code execution flaw in HPE OneView, designated as CVE-2025-37164 and affecting all versions of the software up to version 11.00.

Check Point reported the campaign to CISA on January 7, the peak of the attack wave thus far. The vulnerability was added to the Known Exploited Vulnerabilities catalog on the same day.

“The majority of observed activity originated from a single Dutch IP address that has been widely reported online as suspicious,” Check Point explained. “The campaign impacted organizations across multiple sectors, with the highest concentration of activity observed against government organizations, followed by the financial services and industrial manufacturing sectors.”

According to researchers, targets were distributed globally, with the U.S. experiencing the highest volume of attacks, followed by Australia, France, Germany, and Austria.

Following the discovery of the OneView flaw, HPE shared patches for versions 5.20 through 10.20, with the security hotfix needing to be reapplied after an appliance upgrade from HPE OneView version 6.60.xx to 7.00.00, including any HPE Synergy Composer re-installations.

In a statement regarding the RondoDox threat, HPE wrote that it had not yet received reports directly from customers of the vulnerability being exploited.

“This vulnerability can only be exploited if the threat actor has local access to a user’s network, and we encourage our customers to ensure they are using best security practices in their network environment,” the firm told Techzine.