CVE-2013-2330: HP Storage Data Protector remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 10.0 with network reachability, no authentication and full impact, combined with a very high EPSS score, makes this a top remediation priority despite the thin technical detail.

What it is

HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that lets remote attackers execute arbitrary code. The record gives no root cause, affected component or attack vector detail beyond the network vector, so defenders must rely on the vendor advisory and treat the flaw as fully exploitable until patched.

Impact

A remote attacker can run arbitrary code on the affected Data Protector system, which typically runs with high privileges on backup infrastructure. That gives full compromise of confidentiality, integrity and availability of the host and the data it protects.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The specific service or port is not stated in the record.

Exploitation

The CVE is not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is 0.61043 (99.1st percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Apply the HP vendor patch or upgrade to a fixed Data Protector release as the first action.
• If patching is not immediately possible, restrict network access to Data Protector services to trusted management hosts only.
• Segment backup infrastructure from general user and internet-facing networks.
• Monitor the vendor advisory for updated affected-version and workaround guidance.
• Review Data Protector accounts and service permissions to limit the blast radius of a compromise.

Detection

• Monitor network traffic to Data Protector service ports for unexpected external or untrusted source connections.
• Alert on unusual child processes or command execution spawned by Data Protector services.
• Audit Data Protector logs for authentication failures, configuration changes and abnormal session activity.
• Watch for new outbound connections from backup servers to unknown hosts, which may indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.