--- id: "CVE-2013-4810" kind: "vulnerability" aliases: ["CVE-2013-4810"] title: "Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability" severity: "critical" cvss: 10.0 epss: 0.79468 exploited: true status: "open" category: "vendor" products: [{"name": "Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "HP ProCurve Manager (PCM) / PCM+", "fixed": ["4.00 AutoUpdate #6 04.00.06.628"], "affected": "3.20, 4.0", "ecosystem": "vendor"}, {"name": "HP Identity Driven Manager (IDM)", "fixed": ["PCM 4.00 AutoUpdate #6 04.00.06.628"], "affected": "4.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["deserialization", "exploited", "hp-alm", "hp-idm", "hp-pcm", "hp-procurve-manager", "java", "self-hosted", "vendor"] not_affected_if: ["not-deployed-hp-products", "not-network-reachable", "pcm-4.00-autoupdate-6-or-later"] published_at: "2013-09-16T13:01:46+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T21:57:35+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-4810", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-4810", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:22:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4810", "first_seen_at": "2026-10-23T21:57:35+00:00"}] --- # Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability HP ProCurve Manager (PCM/PCM+) 3.20 and 4.0 and Identity Driven Manager 4.0 expose unauthenticated EJBInvokerServlet and JMXInvokerServlet (JBoss invoker servlets). A remote attacker sends a serialized Java object and runs code as the PCM server user. It is in CISA KEV and a public exploit exists. HP fixed it in 2013 through PCM AutoUpdate. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management affected ? fixed ? - vendor:HP ProCurve Manager (PCM) / PCM+ affected 3.20, 4.0 fixed 4.00 AutoUpdate #6 04.00.06.628 - vendor:HP Identity Driven Manager (IDM) affected 4.0 fixed PCM 4.00 AutoUpdate #6 04.00.06.628 ## How to check In the PCM client, open Help > About (or the AutoUpdate list) and check that PCM is at 04.00.06.628 (AutoUpdate #6) or later. From the network, an HTTP request to /invoker/EJBInvokerServlet or /invoker/JMXInvokerServlet on the PCM server that returns 200 instead of 401/403 means it is exposed. Better still, do not expose the PCM server to untrusted networks. ## Fix Run PCM AutoUpdate and install PCM v4.00 AutoUpdate #6 (04.00.06.628), which covers IDM v4.00 and PCM v4.00 for CVE-2013-4810. For PCM 3.20 the bulletin lists no fix for this CVE, so move to 4.00 and update. Product is end-of-life, so restrict network access to the server and retire it where possible. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-4810 - 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-4810 - 2026-10-23T21:22:45+00:00 analyst — Read HP bulletin HPSBPV02918 (c03897409, 2013-09-09) via bugtraq copy: CVE-2013-4810 (SSRT101127, ZDI-CAN-1760) fixed by PCM v4.00 AutoUpdate #6 04.00.06.628. Bulletin does not list Application Lifecycle Management nor a 3.20 fix for this CVE (3.20 AutoUpdate #8 C.03.20.1741 is listed only for CVE-2013-4813): unknown. PoC: Exploit-DB 28713 (from CVE refs, page not read). Red Hat says same servlets are open in unsupported JBoss AS 4.x/5.x. - 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-4810 ## Documents - [advisory] HPSBPV02918 rev.1 - HP PCM, PCM+ and IDM (bugtraq copy of HP bulletin c03897409) https://lists.openwall.net/bugtraq/2013/09/10/15 - [discussion] Red Hat Bugzilla 1031829: CVE-2013-4810 invoker servlets unauthenticated https://bugzilla.redhat.com/show_bug.cgi?id=1031829 - [poc] Exploit-DB 28713 (listed in CVE references for CVE-2013-4810) https://www.exploit-db.com/exploits/28713 ## From the sources HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_