CVE-2013-2325: HP Storage Data Protector remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with network reachability, no authentication and full confidentiality, integrity and availability impact, and EPSS is above the 99th percentile.

What it is

CVE-2013-2325 is an unspecified vulnerability in HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 that allows remote attackers to execute arbitrary code through unknown vectors. The record gives no root cause, no affected component and no technical detail beyond the ZDI-CAN-1633 identifier, so defenders cannot reason about the exact weakness from this data alone.

Impact

A successful attack lets a remote, unauthenticated attacker run arbitrary code on the Data Protector host, which typically holds backup credentials and access to protected data. That makes full compromise of the backup infrastructure plausible.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The specific service or port is not stated in the record.

Exploitation

The record is not listed in CISA KEV and no public exploit or ransomware usage is documented, but EPSS is very high at 0.61043 (99.1st percentile), suggesting elevated likelihood of attempted exploitation. The only references are duplicate HP vendor advisories.

What to do

• Apply the HP vendor advisory fix for Storage Data Protector 6.20, 6.21, 7.00 and 7.01, or upgrade to a supported release.
• Restrict network access to Data Protector services so only trusted management hosts can reach them.
• Segment backup infrastructure from general user networks and the internet.
• Monitor vendor advisories for updated guidance since the root cause is unspecified.

Detection

• Review Data Protector and host logs for unexpected process creation or command execution on backup servers.
• Alert on inbound connections to Data Protector ports from untrusted or external source addresses.
• Baseline normal Data Protector service traffic and flag anomalies in volume, timing or source.
• Hunt for new or modified binaries and scripts on backup infrastructure hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.