HP Multiple Products Remote Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 16, 2013 · Catalog

   Detected

   HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.

2. Mar 25, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 15, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.

Affected

• cpe hp/application lifecycle managementversion unspecified
• cpe hp/procurve manager3.20
• cpe hp/procurve manager4.0
• vendor Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Managementversion unspecified
• vendor n/a n/aversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2013-4810

  HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

  cisa.gov
• CVE.orgVulnerability recordCVE-2013-4810

  HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: t

  cve.org
• FIRST EPSSExploitation probabilityCVE-2013-4810

  30-day exploitation probability 79.5%

  first.org
• Exploit DatabasePublic exploit reference28713

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2013-4810

  HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: t

  nvd.nist.gov

References

• Broken Link · h20565.www2.hp.com
• Mailing List · marc.info
• Mailing List · marc.info
• Broken Link · secunia.com
• Broken Link · securitytracker.com
• Third Party Advisory · zerodayinitiative.com
• CISA note · nvd.nist.gov
• 28713 · exploit-db.com