CVE-2013-6194: HP Storage Data Protector remote code execution and denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication and full confidentiality, integrity and availability impact, plus public exploit code and very high EPSS.

What it is

HP Storage Data Protector 6.2X contains an unspecified vulnerability that lets remote attackers execute arbitrary code or cause a denial of service. The flaw is tracked as ZDI-CAN-1905 and the vendor advisory and an Exploit-DB entry exist, but the record gives no root cause, affected component or exact version detail beyond the 6.2X line.

Impact

An unauthenticated remote attacker can run arbitrary code on the affected Data Protector host or crash it, giving full compromise of the backup server and any data or credentials it manages.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The description does not name the specific service or port, so the exact entry point is unknown.

Exploitation

The record is not listed in CISA KEV, but EPSS is 0.65924 (99.2nd percentile) and an Exploit-DB reference tagged Exploit exists, indicating public exploit code is available and exploitation is plausible.

What to do

• Apply the HP vendor advisory fix for Storage Data Protector 6.2X (emr_na-c03822422) or upgrade to a supported release.
• Restrict network access to Data Protector services so only trusted management hosts can reach them; do not expose them to untrusted networks.
• Segment backup infrastructure from general user and internet-facing networks to limit lateral movement after compromise.
• Monitor and alert on unexpected process execution or crashes on Data Protector servers.
• If patching is not immediately possible, consider temporary isolation of the affected server from untrusted networks.

Detection

• Monitor Data Protector server logs and host telemetry for unexpected child processes spawned by Data Protector services.
• Alert on service crashes or restarts of Data Protector components that could indicate denial-of-service attempts.
• Watch network traffic to Data Protector management ports from unauthorized or external source addresses.
• Correlate Exploit-DB 31181 activity indicators with host and network logs where feasible.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.