XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
Priority MEDIUM 42CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01515 74th percentileScored 2026-11-07
Fix Fixed HPE Insight Remote Support (Hewlett Packard Enterprise (HPE)): 7.14.0.629
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Insight Remote Support | before 7.14.0.629 | 7.14.0.629 | Patch available | CNA |
- HPE Insight Remote Support VendorHewlett Packard Enterprise (HPE) Affected before 7.14.0.629 Fixed in 7.14.0.629 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:* | before 7.14.0.629 | Vulnerable | Hewlett Packard Enterprise (HPE) |
- cpe:2.3:a:hpe:insight_remote_support:*:*:*:*:*:*:*:* Versions before 7.14.0.629 Vulnerable ·Hewlett Packard Enterprise (HPE)
Remediation
- Fix · CNA HPE Insight Remote Support (Hewlett Packard Enterprise (HPE)) Fixed in 7.14.0.629
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Hewlett Packard Enterprise (HPE) HPE Insight Remote Support 7.14.0.629
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2024-35875 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote SupportPriority HIGH 79
- TI-2024-35874 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote SupportPriority HIGH 69
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11622
- 2026-10-03 Alias added: GHSA-536h-wxcg-vp88
References
More Hewlett Packard Enterprise (HPE) Insight Remote Support vulnerabilities
- TI-2024-35876 Path traversal in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1CRITICAL 9.8
- TI-2024-35875 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1HIGH 7.5
- TI-2025-25009 A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service CVSS 3.1HIGH 7.5
- TI-2025-25010 A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. CVSS 3.1HIGH 7.5
- TI-2024-35874 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1HIGH 7.5
- TI-2025-25011 A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-11622 · CVE Program
- CVE-2024-11622 · NVD
- FIRST EPSS
- GHSA-536h-wxcg-vp88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences