CVE Feed

    Dashboard / CVE / CVE-2016-2004

    CVE-2016-2004

    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.

    Published:Apr 21, 2016
    Last Modified:Apr 12, 2025
    EPS:Apr 21, 2016
    EPSS Score:0.92308
    CVSS Score:9.8

    Affected Products

    Vendor
    Hp
    Product
    Data Protector

    Exploits

    http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.htmlhttps://www.exploit-db.com/exploits/39858/https://www.exploit-db.com/exploits/39874/http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.htmlhttps://www.exploit-db.com/exploits/39858/https://www.exploit-db.com/exploits/39874/https://www.exploit-db.com/exploits/39858https://github.com/marcocarolasec/CVE-2016-2004-Exploithttps://www.exploit-db.com/exploits/39874

    Related CVEs

    CVE-2017-5807 (CVSS 9.8) — A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found…
    CVE-2017-5809 (CVSS 5.5) — A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found…
    CVE-2017-5808 (CVSS 7.5) — A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found…
    CVE-2016-2005 (CVSS 9.8) — HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute ar…
    CVE-2016-2006 (CVSS 9.8) — HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute ar…
    CVE-2016-2007 (CVSS 9.8) — HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute ar…
    CVE-2016-2008 (CVSS 9.8) — HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute ar…
    CVE-2014-5160 (CVSS 6.4) — Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow…
    CVE-2011-2399 (CVSS 7.8) — Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows re…
    CVE-2011-0924 (CVSS 10) — The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command, wh…

    References

    http://packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.html
    http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.html
    http://www.kb.cert.org/vuls/id/267328
    http://www.securitytracker.com/id/1035631
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988
    https://www.exploit-db.com/exploits/39858/
    https://www.exploit-db.com/exploits/39874/
    http://packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.html
    http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.html
    http://www.kb.cert.org/vuls/id/267328
    http://www.securitytracker.com/id/1035631
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988
    https://www.exploit-db.com/exploits/39858/
    https://www.exploit-db.com/exploits/39874/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High