Vulnerability record · CVE-2013-2327 · published 6 June 2013
CVE-2013-2327: HP Storage Data Protector remote code execution flaw
Hp · Storage Data Protector
HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that allows remote code execution. The record gives no root cause, no affected component and no attack vector detail beyond the CVSS rating, so defenders must treat the flaw as fully unauthenticated and network-reachable.
Description
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1635.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 10.0 with network reachability, no authentication and full impact, combined with a very high EPSS score, makes this a top remediation priority despite the thin technical detail.
What it is
HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that allows remote code execution. The record gives no root cause, no affected component and no attack vector detail beyond the CVSS rating, so defenders must treat the flaw as fully unauthenticated and network-reachable.
Impact
A remote attacker can execute arbitrary code on the affected Data Protector host, which given the CVSS impact ratings implies full loss of confidentiality, integrity and availability. Because Data Protector is a backup product, compromise could expose or destroy backed-up data and the backup infrastructure itself.
Attack surface
The CVSS vector AV:N/AC:L/Au:N indicates the flaw is reachable over the network with no authentication and no user interaction. The specific service, port or protocol is not stated in the record.
Exploitation
The CVE is not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is 0.61043 (99.1st percentile), indicating a high modeled likelihood of exploitation activity. No public exploit details are provided in this record.
What to do
- Apply the HP vendor advisory fix for the affected Data Protector versions (6.20, 6.21, 7.00, 7.01) as the first action.
- If patching cannot be done immediately, restrict network access to Data Protector services to trusted management hosts only.
- Segment backup servers from general user networks and the internet so the Data Protector host is not directly reachable.
- Monitor HP advisories for updated guidance, since the record does not identify the vulnerable component or a workaround.
- Review backup server logs and host integrity for signs of compromise before and after patching.
Detection
- Hunt for unexpected inbound connections to Data Protector service ports from untrusted hosts.
- Alert on unusual child processes or command execution spawned by Data Protector services on backup servers.
- Monitor for new or modified files in Data Protector installation and data directories outside normal backup windows.
- Correlate backup server authentication and service logs for anomalous remote sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-2327 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2327), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
