CVE-2014-5160: Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector al...

Security readout for executives and security teams

This CVE describes a remote issue in HP Data Protector’s Cell Request Service where attackers may be able to create, and in one case delete, arbitrary files through directory traversal behavior. The source bundle does not provide affected versions, CVSS, or a vendor fix. The vendor reportedly said the behavior was by design, so remediation depends on current vendor guidance and exposure control. Exposure is most relevant to environments running HP Data Protector with Cell Request Service reachable by untrusted networks. The supplied CVE data does not identify affected versions or CPEs, so teams must confirm product deployment and version status from internal inventory and vendor documentation. Treat this as a high-priority exposure review, not a confirmed emergency. The business risk is strongest where legacy HP Data Protector services are reachable beyond tightly controlled backup networks. Lack of patch and version detail means the immediate action is inventory, access control, vendor confirmation, and monitoring. Mitigation focus: Check current vendor guidance for affected versions and supported remediation.; Restrict Cell Request Service access to trusted backup-management networks only.; Remove public or broad internal exposure where the service is not required..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.