CVE-2005-2773: HP OpenView Network Node Manager command injection in multiple .ovpl scripts

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS 3.1 score of 9.8, KEV listing, and very high EPSS probability make this an urgent patch target.

What it is

HP OpenView Network Node Manager 6.2 through 7.50 passes user-supplied input into shell commands without sanitization in the node parameter of connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl, and ecscmg.ovpl. An unauthenticated remote attacker can inject shell metacharacters to run arbitrary commands on the server. The flaw is severe because it gives full control of a network management host that typically holds broad visibility and credentials across the managed estate.

Impact

An attacker gains arbitrary command execution with the privileges of the NNM web service, allowing full compromise of the host and any credentials or trust relationships it holds. From there, lateral movement into managed network devices and other monitored systems is likely.

Attack surface

Reached over the network through the NNM web interface by sending crafted requests to the affected .ovpl scripts; the CVSS vector shows no privileges or user interaction required. No authentication is indicated as a precondition in the record.

Exploitation

Listed in CISA KEV since 2022-03-25 with a required action to apply vendor updates, and EPSS is 0.74592 (99.5th percentile), indicating high real-world exploitation likelihood. A public exploit reference is tagged in the Bugtraq mailing list entry.

What to do

• Apply the vendor updates referenced in the CISA KEV required action; treat this as the first step.
• If NNM 6.2 through 7.50 cannot be patched or upgraded, isolate the management server from untrusted networks and restrict access to the web interface.
• Place the NNM web interface behind an authenticating reverse proxy or VPN so only trusted administrators can reach the .ovpl endpoints.
• Audit the affected scripts (connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl, ecscmg.ovpl) for input validation and remove shell invocation of user-controlled parameters where feasible.
• Monitor and rotate any credentials stored or used on the NNM host, since compromise would expose them.

Detection

• Inspect web server and NNM logs for requests to connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl, and ecscmg.ovpl containing shell metacharacters (;, |, `, $(), &&) in the node parameter.
• Alert on child processes spawned by the NNM web service (for example shell or command interpreters) that are unexpected for normal operation.
• Baseline outbound connections from the NNM host and alert on new destinations, especially to managed network segments.
• Review host and application logs on the NNM server for command execution artifacts and unusual file writes around the time of suspicious web requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.