First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-53673

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Insight Remote Support	< 7.14.0.629
hpe	insight_remote_support	< 7.14.0.629

References

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_usVendor Advisory

Timeline

Published: Nov 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-536747.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536757.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain CVE-2024-536769.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.CVE-2024-536779.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums CVE-2024-536788.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data CVE-2024-536795.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A CVE-2024-53686.1A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function CVE-2024-536805.5In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()CVE-2024-536815.5In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats CVE-2024-536825.5In the Linux kernel, the following vulnerability has been resolved: regulator: axp20x: AXP717: set ramp_delay AXP717 datasheet says that r CVE-2024-536834.4A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use CVE-2024-536848.8A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially cr