What is the CVSS score of EUVD-2024-54781?

EUVD-2024-54781 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Java are affected by EUVD-2024-54781?

CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server versions before 9.17 that allows authenticated attackers to execute arbitrary code with service-level privileges…. A patch is available.

How to fix or mitigate EUVD-2024-54781?

Within 24 hours: Identify all HPE AutoPass License Server deployments and confirm current versions via 'apls --version' or vendor console; document network access controls and user accounts with authentication privileges. Within 7 days: Apply vendor-released patch to APLS 9.17 or later on all affected systems; validate patch installation and restart APLS services. Within 30 days: Review and restrict network access to APLS to authorized administrative networks only; audit authentication logs for suspicious login attempts; implement network segmentation if APLS is currently accessible from untrusted networks.

Java EUVD-2024-54781

| CVE-2024-51768 HIGH

Code Injection (CWE-94)

2025-07-14 security-alert@hpe.com

RCE Java HP Autopass License Server

8.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:26 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

9.17

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2024-54781

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

CVE Published

Jul 14, 2025 - 11:15 nvd

HIGH 8.0

DescriptionNVD

An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.

AnalysisAI

CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17, stemming from unsafe deserialization in the embedded HSQLDB database library. An authenticated attacker with local network access can execute arbitrary code with the privileges of the APLS service, potentially leading to complete system compromise. The vulnerability has a CVSS score of 8.0 and represents a significant risk to organizations using affected APLS versions, particularly given the authentication requirement is modest (PR:L) and the attack complexity is low.

Technical ContextAI

The vulnerability resides in HPE AutoPass License Server's use of HSQLDB (HyperSQL Database), a Java-based embedded relational database engine. The root cause is classified as CWE-94 (Improper Control of Generation of Code - 'Code Injection'), which in this context specifically involves unsafe deserialization of untrusted data within HSQLDB's communication or serialization mechanisms. HSQLDB allows remote procedure calls and object serialization for inter-process communication; when input validation is insufficient, attackers can craft malicious serialized objects that execute arbitrary code upon deserialization. The affected CPE likely encompasses cpe:2.7.a:hpe:autopass_license_server:*:*:*:*:*:*:*:* with versions <9.17. APLS uses HSQLDB for its license database backend, making this library-level vulnerability directly exploitable through APLS interfaces.

RemediationAI

Immediate Actions: (1) UPGRADE to HPE AutoPass License Server 9.17 or later immediately. HPE has released patched versions that address the HSQLDB deserialization vulnerability. (2) If immediate upgrade is not feasible, implement these workarounds: (a) Restrict network access to APLS administrative interfaces using firewall rules—limit to trusted administrative networks only (whitelist source IPs); (b) Disable or restrict APLS REST API/remote access features if not required; (c) Apply network segmentation to isolate APLS servers from general user networks; (d) Monitor APLS logs for suspicious serialization activity or unusual object instantiation patterns. (3) Verify patch installation by confirming APLS version >= 9.17 via CLI or UI. (4) Consult HPE Security Advisory (references section) for detailed patch notes, rollback procedures, and verification steps. (5) After patching, review APLS access controls and authentication mechanisms to ensure principle of least privilege is enforced.