Hewlett Packard RCE Vulnerability Let Attackers to Bypass Authentication and Execute Commands Remotely

This report describes CVE-2024-13804, a critical design vulnerability in HPE Insight CMU v8.2 that allows attackers to bypass client-side authentication, modify the Java client to unlock administrative functionality, and use Java RMI to execute arbitrary commands with root privileges across HPC management and compute nodes; because CMU is end-of-life and will not receive a patch, the report urges immediate mitigations such as network isolation, stricter access controls, and migration to supported management solutions.