CVE-2011-0924: The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command,...

Security readout for executives and security teams

This flaw lets a remote attacker make an HP Data Protector client run attacker-supplied script code by abusing a trusted command filename. In business terms, a vulnerable backup client could become an entry point for system compromise. The bundle does not include affected versions, CVSS, or patch details. Exposure is most likely where legacy HP Data Protector clients remain installed and reachable by systems outside tightly controlled backup infrastructure. Exact affected versions are not available in the bundle, so teams must confirm against HP advisory SSRT100441 and ZDI-11-054. Prioritize if HP Data Protector is still present, especially on critical backup infrastructure. Backup systems often have broad access, so compromise could affect recovery capability and wider enterprise systems. If the product is not in use, document non-exposure. Mitigation focus: Check HP advisory SSRT100441 for affected versions and vendor remediation.; Apply vendor-provided fixes if your deployed version is listed as affected.; Restrict Data Protector client access to trusted backup infrastructure only..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.