VDB
CVE-2016-2004
CVE-2016-2004
PUBLISHED
CVSS 9.800000190734863 CRITICAL
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
EPSS 92.73% · 99.8th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
92.73%
99.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hp | data_protector | 7.0, 8.0, 9.0 |
| n/a | n/a | n/a |
Timeline
- Apr 21, 2016 CVE Published
- May 26, 2016 PoC Published
- May 26, 2016 PoC Published
- May 31, 2016 PoC Published
- May 31, 2016 PoC Published
- May 29, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 3, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
References
- VU#267328 third-party-advisory
- 39874 exploit
- http://packetstormsecurity.com/files/137199/HP-Data-Protector-A.09.00-Command-Execution.html url
- http://packetstormsecurity.com/files/137341/HP-Data-Protector-Encrypted-Communication-Remote-Command-Execution.html url
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988 url
- 39858 exploit
- 1035631 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2016-2004 advisory
- https://www.exploit-db.com/exploits/39858 url
- https://www.exploit-db.com/exploits/39874 url