The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share…

published 2011-02-09 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-0934

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 64.2%; EPSS 64.2% chance of exploitation in 30 days, percentile 99.2%
public exploits: 4; Metasploit, Exploit-DB

The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.

Timeline

2011-02-09 Published
2011-05-29 First public exploit (EDB-17345)

Exploit prediction

64.22% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/misc/hp_dataprotector_install_service HP Data Protector 6.10/6.11/6.20 Install Service metasploit exploit, excellent rank, 2011-11-02
EDB-27271 HP Data Protector - CMD Install Service (Metasploit) remote, 2013-08-02
EDB-19288 HP Data Protector Client - EXEC_CMD Remote Code Execution remote, 2012-06-19
EDB-17345 HP Data Protector Client 6.11 - 'EXEC_SETUP' Remote Code Execution remote, 2011-05-29

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

marc.info /?l=bugtraq&m=130391284726795&w=2
vendor-advisory
vupen.com /english/advisories/2011/0308
vdb-entry, vendor-advisory
dvlabs.tippingpoint.com /blog/2011/02/07/zdi-disclosure-hp
zerodayinitiative.com /advisories/ZDI-11-056/
securityfocus.com /bid/46234
vdb-entry
securityfocus.com /archive/1/516272/100/0/threaded
mailing-list

Sources

CVE List CVE-2011-0922
NVD CVE-2011-0922

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary