CVE-2013-2326: HP Storage Data Protector remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication and full impact, plus a very high EPSS percentile, warrants urgent patching despite the thin technical detail.

What it is

HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that allows remote attackers to execute arbitrary code via unknown vectors, tracked as ZDI-CAN-1634. The record gives no root cause, no affected component and no technical detail, so defenders must rely on the vendor advisory and the CVSS vector.

Impact

A remote, unauthenticated attacker can execute arbitrary code on the affected Data Protector host, which given the CVSS 2.0 score of 10 implies full loss of confidentiality, integrity and availability. Because Data Protector is backup infrastructure, compromise can expose or destroy backed-up data across the environment.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The specific service or port is not stated in the record.

Exploitation

The record does not state that exploitation has occurred; CVE-2013-2326 is not listed in CISA KEV, and the only references are duplicate vendor advisories with no exploit tag. EPSS gives a 30-day probability of 0.61043 (99.1st percentile), indicating high predicted likelihood of exploitation activity.

What to do

• Apply the HP vendor advisory fix for Storage Data Protector 6.20, 6.21, 7.00 and 7.01, or upgrade to a supported release.
• Restrict network access to Data Protector services so only trusted management hosts can reach them; do not expose them to untrusted networks.
• Segment backup infrastructure from general user and internet-facing networks.
• Monitor the vendor advisory for updated technical detail and re-check exposure of any remaining unsupported versions.

Detection

• Review network logs for unexpected inbound connections to Data Protector hosts from untrusted sources.
• Monitor Data Protector and host process logs for anomalous child processes or command execution on backup servers.
• Alert on new or unusual outbound traffic from backup infrastructure, which can indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.