CVE-2013-4811: HP ProCurve Manager SNAC server adCert validation flaw allows JSP upload and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10 and a high EPSS probability, though no confirmed in-the-wild exploitation is recorded.

What it is

The UpdateDomainControllerServlet in the SNAC registration server of HP ProCurve Manager (PCM) 3.20/4.0, PCM+ 3.20/4.0, and Identity Driven Manager 4.0 fails to properly validate the adCert argument. This lets a remote attacker upload .jsp files to the server and execute arbitrary code. Because the flaw is reachable over the network without authentication and yields full control of the host, it is a serious risk for any exposed deployment.

Impact

An unauthenticated remote attacker can upload and execute arbitrary JSP code on the SNAC registration server, gaining full control of the affected system (complete confidentiality, integrity, and availability impact per the CVSS vector).

Attack surface

Reachable over the network via the UpdateDomainControllerServlet HTTP endpoint; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at roughly 0.71 (99th percentile), and references include a Zero Day Initiative advisory (ZDI-13-226), indicating public technical detail exists, though the record does not confirm active exploitation.

What to do

• Apply the HP vendor advisory fix for PCM/PCM+/IDM (emr_na-c03897409) or upgrade to a supported release.
• Restrict network access to the SNAC registration server so only trusted management hosts can reach it.
• Block or filter requests to UpdateDomainControllerServlet and reject .jsp uploads at the perimeter or reverse proxy.
• Run the affected service with least privilege and isolate it from other management infrastructure.
• If no patch is available, retire or replace the end-of-life product.

Detection

• Monitor web logs for POST requests to UpdateDomainControllerServlet, especially with adCert parameters or multipart uploads.
• Alert on newly created .jsp files in web-accessible directories on the SNAC server.
• Watch for unexpected child processes spawned by the web server or Java service (e.g., cmd.exe, /bin/sh).
• Review outbound connections from the SNAC host for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.