CVE-2013-2334: HP Storage Data Protector remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable code execution with maximum CVSS 2.0 impact and very high EPSS probability makes this a top remediation priority despite thin technical detail.

What it is

HP Storage Data Protector versions 6.20, 6.21, 7.00 and 7.01 contain an unspecified vulnerability that lets remote attackers execute arbitrary code. The record gives no root cause, affected component or attack vector detail beyond the network vector, so the exact flaw is unknown. It matters because a network-reachable code execution bug in backup software can expose both the backup server and the data it protects.

Impact

An unauthenticated remote attacker can run arbitrary code on the affected Data Protector system, gaining full control of confidentiality, integrity and availability per the CVSS 2.0 score of 10. That places backup infrastructure and any credentials or data it handles at risk.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The specific service or port is not stated in the record.

Exploitation

The record is not listed in CISA KEV and has no exploit-tagged references, but EPSS is 0.47128 (98.78th percentile), indicating a high predicted likelihood of exploitation activity. No public exploit or in-the-wild use is confirmed by the supplied data.

What to do

• Apply the HP vendor advisory fix for the affected Data Protector versions (6.20, 6.21, 7.00, 7.01) as the first action.
• If patching cannot be done immediately, restrict network access to Data Protector services to trusted management hosts only.
• Segment backup servers from general user and internet-facing networks to limit reachable attack paths.
• Monitor HP advisories for updated guidance, since the record does not identify the vulnerable component.
• Review Data Protector logs and host activity for unexpected remote code execution or process creation.

Detection

• Monitor network traffic to Data Protector service ports for unexpected or anomalous remote connections.
• Alert on unusual child processes or command execution spawned by Data Protector services.
• Review authentication and access logs on backup servers for connections from untrusted sources.
• Correlate host telemetry for signs of post-exploitation activity on systems running the affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.