CVE-2024-53675: HPE Insight Remote Support XXE information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication, and high confidentiality impact, plus a very high EPSS score, though no confirmed exploitation is documented.

What it is

HPE Insight Remote Support contains an XML external entity (XXE) injection flaw, tracked as CWE-611/CWE-91. A remote, unauthenticated attacker can submit crafted XML that causes the service to resolve external entities, potentially disclosing information. The record does not specify affected versions or the exact vulnerable component.

Impact

An attacker can read information the vulnerable service can access, with high confidentiality impact but no integrity or availability effect per the CVSS vector. The description limits this to disclosure 'in certain cases', so the scope of readable data is not fully defined.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). The flaw is triggered by XML input processed by the Insight Remote Support service, but the record does not identify the specific endpoint or interface.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; the single reference is a vendor advisory. EPSS is very high (0.83629, 99.7th percentile), indicating elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the HPE security bulletin fix for Insight Remote Support (hpesbgn04731en_us) as the first action.
• If patching is delayed, restrict network access to the Insight Remote Support service to trusted management hosts only.
• Disable external entity and DTD processing in the XML parser used by the service where configuration allows.
• Monitor the vendor advisory for updated affected-version details and any revised guidance.

Detection

• Inspect XML request bodies to the Insight Remote Support service for DOCTYPE declarations, ENTITY definitions, or SYSTEM/PUBLIC identifiers.
• Alert on outbound network connections or DNS lookups originating from the Insight Remote Support host to unexpected external addresses.
• Review service logs for XML parsing errors or unusual request patterns from untrusted source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.