CVE-2024-53676 - Vulnerability Details

Vendors	Products
Hpe	Insight Remote Support

Link	Providers
https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us

Type	Values Removed	Values Added
References		https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses		CWE-22

Type	Values Removed	Values Added
First Time appeared		Hpe Hpe insight Remote Support
CPEs		cpe:2.3:a:hpe:insight_remote_support::::::::
Vendors & Products		Hpe Hpe insight Remote Support
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
Weaknesses		CWE-552
References		https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-53676", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2024-11-21T16:51:49.640Z", "datePublished": "2024-11-27T00:18:28.527Z", "dateUpdated": "2025-03-05T14:58:05.646Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HPE Insight Remote Support", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThan": "7.14.0.629", "status": "affected", "version": "0", "versionType": "product"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.</pre>"}], "value": "A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution."}], "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-11-27T00:18:28.527Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"references": [{"url": "https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676", "tags": ["exploit"]}], "affected": [{"vendor": "hpe", "product": "insight_remote_support", "cpes": ["cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.14.0.629", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-05T14:56:50.587693Z", "id": "CVE-2024-53676", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T14:58:05.646Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-53676 (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

state : PUBLISHED (string)

assignerShortName : hpe (string)

dateReserved : 2024-11-21T16:51:49.640Z (string)

datePublished : 2024-11-27T00:18:28.527Z (string)

dateUpdated : 2025-03-05T14:58:05.646Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : HPE Insight Remote Support (string)

vendor : Hewlett Packard Enterprise (HPE) (string)

versions : [ »

0 : { »

lessThan : 7.14.0.629 (string)

status : affected (string)

version : 0 (string)

versionType : product (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <pre>A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.</pre> (string)

}

]

value : A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-549 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-549 Local Execution of Code (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-552 (string)

description : CWE-552 Files or Directories Accessible to External Parties (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2024-11-27T00:18:28.527Z (string)

}

references : [ »

0 : { »

url : https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

references : [ »

0 : { »

url : https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676 (string)

tags : [ »

0 : exploit (string)

]

}

]

affected : [ »

0 : { »

vendor : hpe (string)

product : insight_remote_support (string)

cpes : [ »

0 : cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 7.14.0.629 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-05T14:56:50.587693Z (string)

id : CVE-2024-53676 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-05T14:58:05.646Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-53676", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-05T14:56:50.587693Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:*"], "vendor": "hpe", "product": "insight_remote_support", "versions": [{"status": "affected", "version": "0", "lessThan": "7.14.0.629", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T12:01:39.293Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Insight Remote Support", "versions": [{"status": "affected", "version": "0", "lessThan": "7.14.0.629", "versionType": "product"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.", "supportingMedia": [{"type": "text/html", "value": "<pre>A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.</pre>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2024-11-27T00:18:28.527Z"}}}, "cveMetadata": {"cveId": "CVE-2024-53676", "state": "PUBLISHED", "dateUpdated": "2025-03-05T14:58:05.646Z", "dateReserved": "2024-11-21T16:51:49.640Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2024-11-27T00:18:28.527Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-53676 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-05T14:56:50.587693Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:* (string)

]

vendor : hpe (string)

product : insight_remote_support (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 7.14.0.629 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

references : [ »

0 : { »

url : https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676 (string)

tags : [ »

0 : exploit (string)

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-27T12:01:39.293Z (string)

}

]

cna : { »

source : { »

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-549 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-549 Local Execution of Code (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Hewlett Packard Enterprise (HPE) (string)

product : HPE Insight Remote Support (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 7.14.0.629 (string)

versionType : product (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <pre>A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.</pre> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-552 (string)

description : CWE-552 Files or Directories Accessible to External Parties (string)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2024-11-27T00:18:28.527Z (string)

}

cveMetadata : { »

cveId : CVE-2024-53676 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-05T14:58:05.646Z (string)

dateReserved : 2024-11-21T16:51:49.640Z (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

datePublished : 2024-11-27T00:18:28.527Z (string)

assignerShortName : hpe (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4E9BD73-DBE0-4625-95B9-AADC28A9BC6D", "versionEndExcluding": "7.14.0.629", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution."}, {"lang": "es", "value": "Una vulnerabilidad de directory traversal en Hewlett Packard Enterprise Insight Remote Support podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2024-53676", "lastModified": "2025-03-05T15:15:14.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-alert@hpe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-11-27T01:15:05.250", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "security-alert@hpe.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D4E9BD73-DBE0-4625-95B9-AADC28A9BC6D (string)

versionEndExcluding : 7.14.0.629 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de directory traversal en Hewlett Packard Enterprise Insight Remote Support podría permitir la ejecución remota de código. (string)

}

]

id : CVE-2024-53676 (string)

lastModified : 2025-03-05T15:15:14.717 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : security-alert@hpe.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-11-27T01:15:05.250 (string)

references : [ »

0 : { »

source : security-alert@hpe.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us (string)

}

1 : { »

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

url : https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676 (string)

}

]

sourceIdentifier : security-alert@hpe.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-552 (string)

}

]

source : security-alert@hpe.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object