CVE-2008-0067: HP OpenView Network Node Manager CGI stack buffer overflows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10 and very high EPSS probability on an internet-exposed management product.

What it is

HP OpenView Network Node Manager 7.01, 7.51 and 7.53 contain multiple stack-based buffer overflows in CGI programs OpenView5.exe, getcvdata.exe, ovlaunch.exe and Toolbar.exe, triggered by long string parameters. Because these are remotely reachable CGI endpoints, the flaw allows unauthenticated code execution on the management server, which is a high-value target.

Impact

A remote attacker can execute arbitrary code with the privileges of the NNM web service, potentially taking full control of the management host.

Attack surface

Reached over the network via HTTP requests to the affected CGI programs with oversized string parameters; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.634, 99th percentile), and references are vendor advisories and research write-ups rather than exploit code.

What to do

• Apply the HP vendor patch or upgrade to a fixed NNM release; this is the first action.
• If patching is not possible, restrict access to the NNM web/CGI interface to trusted management networks only.
• Disable or remove unused CGI programs (OpenView5.exe, getcvdata.exe, ovlaunch.exe, Toolbar.exe) where they are not required.
• Place the NNM server behind a reverse proxy or WAF that rejects oversized parameters to the CGI endpoints.
• Monitor vendor advisories for updated guidance since the record is old and may not reflect current support status.

Detection

• Inspect web server logs for requests to OpenView5.exe, getcvdata.exe, ovlaunch.exe or Toolbar.exe with unusually long query strings or parameters.
• Alert on HTTP 500 responses or crashes from the NNM web service that follow large parameter submissions.
• Monitor for unexpected child processes spawned by the NNM web service, which may indicate successful exploitation.
• Review network traffic to the NNM management port from untrusted sources for anomalous CGI requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.