CVE-2013-4810: HP ProCurve Manager and IDM Java deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, active inclusion in CISA KEV, and a very high EPSS score make this an urgent fix for any exposed instance.

What it is

HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager 4.0, and Application Lifecycle Management accept marshalled objects sent to EJBInvokerServlet or JMXInvokerServlet, allowing remote code execution. The flaw is a code injection (CWE-94) reachable over the network with no authentication, and it is listed in CISA KEV, so it matters for any organization still running these legacy HP management products.

Impact

An unauthenticated remote attacker can execute arbitrary code on the affected server, gaining full control of the host and any data or credentials it holds.

Attack surface

Reached over the network by sending a crafted marshalled object to the EJBInvokerServlet or JMXInvokerServlet HTTP endpoints. The CVSS vector shows no privileges and no user interaction required, so exposure depends on whether those servlets are reachable.

Exploitation

CVE-2013-4810 is in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of about 0.79 (99.6th percentile), and a public Exploit-DB entry exists. No ransomware campaign use is documented.

What to do

• Apply the HP vendor updates referenced in the advisory; if no supported fix exists for the installed version, migrate off the affected product.
• Block or restrict network access to EJBInvokerServlet and JMXInvokerServlet, and do not expose these management interfaces to untrusted networks.
• Isolate affected PCM, PCM+, IDM, and Application Lifecycle Management hosts behind firewalls and segmentation.
• Retire or upgrade end-of-life HP management products that no longer receive security fixes.
• Monitor for and investigate any unexpected process execution or outbound connections from these servers.

Detection

• Alert on HTTP requests to EJBInvokerServlet or JMXInvokerServlet, especially POSTs with binary or serialized payloads.
• Monitor for child processes spawned by the Java process hosting these servlets.
• Review network logs for external connections to the management ports used by these products.
• Hunt for known exploitation artifacts or payloads associated with the public Exploit-DB entry for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.