CVE-2013-3576: HP System Management Homepage command injection via snmpchp.php PATH_INFO

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote authenticated command execution with complete host impact and a high EPSS score, though exploitation requires valid credentials and no KEV listing is present.

What it is

ginkgosnmp.inc in HP System Management Homepage (SMH) fails to sanitize shell metacharacters in the PATH_INFO passed to smhutil/snmpchp.php.en, allowing OS command injection. An attacker who can reach the endpoint with valid credentials can run arbitrary commands on the host, which matters because SMH is a management component often running with elevated privileges.

Impact

An authenticated remote attacker gains arbitrary command execution on the SMH server, leading to full compromise of confidentiality, integrity and availability of that host.

Attack surface

Reached over the network via HTTP requests to smhutil/snmpchp.php.en with crafted PATH_INFO; the CVSS vector (AV:N/AC:L/Au:S) indicates authentication is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high (0.666, 99.3rd percentile) and CERT/CC references are tagged Exploit, indicating public exploit information exists.

What to do

• Apply the HP/SMH vendor patch referenced in the CERT/CC advisory (VU#735364) as the first action.
• Restrict network access to the SMH web interface to trusted management networks only.
• Enforce least privilege and strong unique credentials for SMH accounts, and remove unused accounts.
• If SMH is not required, disable or uninstall it; otherwise run it with the lowest privileges possible.
• Monitor vendor advisories for updated fixes since the record is old and status is Modified.

Detection

• Inspect web server and SMH logs for requests to smhutil/snmpchp.php.en containing shell metacharacters (;, |, &, $(), backticks) in the URL path.
• Alert on unexpected child processes spawned by the SMH web service (e.g., shell or command interpreters).
• Monitor for outbound connections or file writes originating from the SMH process outside normal behavior.
• Correlate SMH authentication events with subsequent suspicious command execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.