CVE-2013-4837: HP LoadRunner Virtual User Generator remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication, and full impact, combined with a very high EPSS percentile, makes this a top remediation priority despite the lack of public exploit details.

What it is

HP LoadRunner before 11.52 contains an unspecified vulnerability in the Virtual User Generator component that allows remote code execution. The flaw is network-reachable with no authentication required, and the vendor advisory is the only technical reference, so the exact vulnerable code path is not public.

Impact

A remote attacker can execute arbitrary code on the affected system, gaining full control of confidentiality, integrity and availability. Because the component is used for load testing, a compromised host may also expose test infrastructure and credentials.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The description does not specify which protocol or port the Virtual User Generator listens on, so the exact entry point is unknown.

Exploitation

The record is not listed in CISA KEV and has no public exploit references, but EPSS is 0.62617 (99.15th percentile), indicating a high modeled likelihood of exploitation activity. No confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade HP LoadRunner to version 11.52 or later as directed by the vendor advisory.
• If upgrade is not possible, isolate LoadRunner Virtual User Generator hosts on a segmented network and restrict inbound access to trusted management systems only.
• Block or tightly filter network access to the LoadRunner services from untrusted networks using host and perimeter firewalls.
• Monitor the vendor advisory page for updated guidance and any revised fixed versions.
• Treat LoadRunner hosts as high-value assets and apply least-privilege accounts for any services running on them.

Detection

• Monitor network traffic to LoadRunner Virtual User Generator hosts for unexpected inbound connections from untrusted sources.
• Alert on unusual child processes or command execution originating from LoadRunner service processes.
• Review LoadRunner host logs for crashes, unexpected restarts, or anomalous service behavior that could indicate exploitation attempts.
• Use file integrity monitoring on LoadRunner installation directories to detect unauthorized changes to binaries or scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.