CveMateVulnerability intelligence

CVE-2016-2004: hp data_protector

CVSS: 9.8v3.0CriticalModified

Published 21-04-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-2004 is a critical (CVSS 9.8) vulnerability in hp data_protector. EPSS estimates a 94.25% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

94.25%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Timeline

21-04-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.

CVSS metrics

2 scores · 1 source · 2 versions

v3.09.8v2.09.3

EPSS trend

Probability

94.25%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 94.25% on 19-09-2026

19-09-202619-10-2026

EPSS score

94.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaseremotewindowsVerified
HP Data Protector A.09.00 - Arbitrary Command Execution
Maturity: weaponized
exploit-databaseremotewindowsVerified
HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteUnverified
HP Data Protector Encrypted Communication Remote Command Execution
exploit/windows/misc/hp_dataprotector_encrypted_comms
Maturity: poc

Weaknesses

CWE · root cause

CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected systems

Hp1 product

data_protector≥ 7.0, < 7.03_108 | ≥ 8.0, < 8.15 | ≥ 9.0, < 9.06

1 vendor · 1 product

References

7 links

www.kb.cert.org/vuls/id/267328Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.exploit-db.com/exploits/39874/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.htmlX Refsource MISCThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988X Refsource CONFIRMVendor Advisory
www.exploit-db.com/exploits/39858/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1035631VDB EntryX Refsource SECTRACKThird Party Advisory