Vulnerability record · CVE-2024-53674 · published 26 November 2024
CVE-2024-53674: HPE Insight Remote Support XXE information disclosure
Hpe · Insight Remote Support
HPE Insight Remote Support contains an XML external entity (XXE) injection flaw (CWE-611/CWE-91) that can let remote users disclose information in certain cases. The vulnerability is network-reachable with no privileges or user interaction required, and the CVSS 3.1 base score is 7.5 (HIGH) with high confidentiality impact only.
Description
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityCVSS 7.5 HIGH with no authentication or interaction required and a very high EPSS percentile, though no known exploitation is documented.
What it is
HPE Insight Remote Support contains an XML external entity (XXE) injection flaw (CWE-611/CWE-91) that can let remote users disclose information in certain cases. The vulnerability is network-reachable with no privileges or user interaction required, and the CVSS 3.1 base score is 7.5 (HIGH) with high confidentiality impact only.
Impact
An attacker can read files or data accessible to the affected service, resulting in information disclosure. Integrity and availability are not affected per the CVSS vector.
Attack surface
Reachable over the network via the XML parsing path in Insight Remote Support, with no authentication (PR:N) and no user interaction (UI:N) required. The record does not specify the exact endpoint or interface.
Exploitation
Not listed in CISA KEV and no public exploit references are provided; EPSS is 0.46671 (98.8th percentile), indicating elevated predicted exploitation likelihood. Only a vendor advisory reference is present.
What to do
- Apply the HPE vendor advisory fix for Insight Remote Support (hpesbgn04731en_us) as the first action.
- Disable external entity and DTD processing in the XML parser used by the product where configuration allows.
- Restrict network access to Insight Remote Support interfaces to trusted management networks.
- Monitor for unexpected outbound requests or file reads originating from the service.
Detection
- Inspect XML payloads sent to Insight Remote Support for DOCTYPE, ENTITY, or SYSTEM/PUBLIC declarations.
- Alert on outbound DNS or HTTP connections from the service host to unusual external destinations.
- Review service logs for anomalous file access or parsing errors tied to XML input.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us | Vendor Advisory |
Track CVE-2024-53674 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-53674), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
