CVE-2007-6204: HP OpenView Network Node Manager stack buffer overflow in multiple CGI executables

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS v2 10.0 with network reachability, no authentication, and public exploit references make this a high-impact, readily exploitable flaw despite the absence of KEV listing.

What it is

HP OpenView Network Node Manager (OV NNM) versions 6.41, 7.01 and 7.51 contain multiple stack-based buffer overflows in ovlogin.exe, OpenView5.exe, snmpviewer.exe and webappmon.exe. Long arguments, such as the Action parameter to OpenView5.exe, can overwrite the stack and allow remote code execution. The flaw is remotely reachable and carries a CVSS v2 score of 10.0.

Impact

A remote attacker can execute arbitrary code with the privileges of the affected service, which typically runs with elevated rights on the management server. This can lead to full compromise of the NNM host and any managed network context it holds.

Attack surface

The vulnerable executables are network-facing CGI components of OV NNM, reached over HTTP with no authentication required per the CVSS vector (AV:N/AC:L/Au:N). No user interaction is indicated by the description or vector.

Exploitation

The record is not listed in CISA KEV, but EPSS is 0.69613 (99.33rd percentile) and references include an Exploit tag on SecurityFocus BID 26741 and an Exploit-DB entry, indicating public exploit material exists.

What to do

• Apply the HP vendor patch referenced in the HP support document and SecurityFocus BID 26741.
• If patching is not immediately possible, restrict network access to the NNM web interface and CGI executables to trusted management hosts only.
• Disable or remove unused CGI components such as ovlogin.exe, OpenView5.exe, snmpviewer.exe and webappmon.exe where they are not required.
• Run the NNM service under a least-privilege account and isolate the management server on a segmented network.
• Monitor vendor advisories for updated guidance since the product line is legacy and may be end-of-support.

Detection

• Inspect HTTP request logs for unusually long parameters, especially Action values sent to OpenView5.exe and other listed CGI binaries.
• Alert on crashes or restarts of ovlogin.exe, OpenView5.exe, snmpviewer.exe or webappmon.exe, which may indicate failed overflow attempts.
• Use network IDS signatures for known exploit patterns against the NNM CGI endpoints and review traffic to the management interface from unexpected sources.
• Correlate process creation of the affected executables with anomalous child processes or outbound connections from the NNM host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.