CVE-2011-1865: HP OpenView Storage Data Protector inet service stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent remote code execution risk.

What it is

The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 contains multiple stack-based buffer overflows that can be triggered by a request with crafted parameters. Because the service is network-facing and the flaw allows remote code execution, it is a serious risk to any exposed Data Protector installation.

Impact

A remote attacker can execute arbitrary code with the privileges of the inet service, potentially leading to full compromise of the backup server and any data it manages.

Attack surface

The vulnerability is reached over the network via the inet service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced (Core Security and Exploit-DB), and EPSS is very high at 0.88948 (99.77th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or upgrade to a fixed version of HP OpenView Storage Data Protector as directed by HP.
• Restrict network access to the inet service to trusted management hosts using firewall rules or network segmentation.
• Disable or stop the inet service if it is not required for operations.
• Monitor vendor advisories for updated guidance and verify the installed version is no longer affected.

Detection

• Inspect network traffic to the inet service port for unusually long or malformed request parameters.
• Review service logs for crashes or abnormal termination of the inet process.
• Use IDS/IPS signatures that detect known exploit patterns for this vulnerability.
• Audit exposed Data Protector instances to confirm they are not reachable from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.