CVE-2013-4810VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2013-4810: HP Multiple Products Remote Code Execution Vulnerability

Affects Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle ManagementSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 79.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2013-4810 (opens in a new tab)

Description

CVE-2013-4810 is a remote code execution vulnerability affecting multiple HP products including ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management. The flaw allows remote attackers to execute arbitrary code by sending a specially crafted marshalled object to either the EJBInvokerServlet or JMXInvokerServlet. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability involves remote code execution via deserialization of untrusted data in HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management products. Attackers can exploit the flaw by sending a malicious marshalled object to the EJBInvokerServlet or JMXInvokerServlet, leading to arbitrary code execution on the affected system. The vulnerability is tracked as CVE-2013-4810 and is known to have been exploited in the wild. No vendor advisory or patch information is provided in the input data.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on affected HP products, potentially leading to full system compromise. This can result in unauthorized control over the affected systems and disruption of services.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HP security advisories for updates. Until a fix is available, restricting network access to the affected servlets and applying network-level controls to limit exposure may reduce risk.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:56:02 UTC

Weaknesses

References

Related threats