Vulnerability record · CVE-2013-2332 · published 6 June 2013
CVE-2013-2332: HP Storage Data Protector remote code execution flaw
Hp · Storage Data Protector
HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that lets remote attackers execute arbitrary code. The record gives no root cause or affected component, so defenders must rely on the vendor advisory and network exposure rather than a specific flaw class.
Description
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1654.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 10.0 with network-reachable, unauthenticated code execution on backup infrastructure and a 99th percentile EPSS score make this a top remediation target despite the thin technical detail.
What it is
HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that lets remote attackers execute arbitrary code. The record gives no root cause or affected component, so defenders must rely on the vendor advisory and network exposure rather than a specific flaw class.
Impact
A successful attack gives the attacker arbitrary code execution on the Data Protector host, which typically runs with high privileges and can reach backup data and managed clients. Full confidentiality, integrity and availability impact is indicated by the CVSS vector.
Attack surface
The CVSS vector AV:N/AC:L/Au:N means the flaw is reachable over the network with no authentication and no user interaction. The exact protocol or service is not stated in the record.
Exploitation
The CVE is not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is 0.61043 (99th percentile), indicating a high predicted likelihood of exploitation activity.
What to do
- Apply the HP vendor advisory fix for Storage Data Protector 6.20, 6.21, 7.00 and 7.01, or upgrade to a supported release.
- Restrict network access to Data Protector services to trusted management hosts only; do not expose them to untrusted networks.
- Segment backup infrastructure from general user and internet-facing networks.
- Monitor vendor advisories for updated guidance since the root cause is unspecified.
Detection
- Review Data Protector and host logs for unexpected process creation or command execution on backup servers.
- Alert on inbound connections to Data Protector ports from hosts outside the approved management range.
- Baseline normal Data Protector service traffic and flag new or anomalous remote sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-2332 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2332), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
