Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-13804 is a critical-severity Improper Authentication (CWE-287) vulnerability in 0Xbad53C (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-13804 is an unauthenticated remote code execution (RCE) vulnerability affecting the HPE Insight Cluster Management Utility. Classified under CWE-287 (Improper Authentication), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact exploitation over the network with low complexity and no privileges required.
Unauthenticated remote attackers who can reach the affected HPE Insight Cluster Management Utility over the network can exploit this flaw without user interaction. Successful exploitation enables arbitrary code execution on the target system, resulting in high confidentiality, integrity, and availability impacts.
Mitigation guidance and additional details, including vulnerability research and potential patches, are documented in the referenced publication at https://red.0xbad53c.com/vulnerability-research/rce-in-hpe-insight-cluster-management-utility-cve-2024-13804. Security practitioners should consult this source and monitor for official HPE advisories.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54340
Vulnerability Data
Unauthenticated RCE in HPE Insight Cluster Management Utility
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Enforces access only after approved authorizations, which presupposes correct authentication has occurred.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.
A.8.26 explicitly requires identifying and addressing authentication-related requirements (including level of trust in identity via 8.5 and 5.17) as part of application development or acquisition, which prevents a slice of CWE-287 but leaves the dominant sufficiency-of-proof aspects (IA-2/IA-5) and many implementation defects untouched.
A.8.27 mandates security-by-design principles (least privilege, default-deny, never-trust/always-verify, MFA, end-to-end encryption of requests, distrust-external-input, secure session control, and explicit authentication/authorization in every layer), which directly stops most improper-authentication flaws from being exploitable; the bounded remainder is insufficient-proof cases that live only in the strength or correctness of the credential itself (IA-5/IA-2 territory).
A.8.5 directly mandates appropriate-strength authentication techniques, MFA for critical systems, protected log-on procedures, brute-force resistance, no cleartext passwords/transmission, and session controls that stop exploitation of insufficient proof of identity; the bounded remainder is cases where the chosen technique itself is flawed or insufficiently implemented (e.g. weak biometrics without fallback).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.