Vulnerability record · CVE-2009-0920 · published 25 March 2009
CVE-2009-0920: HP OpenView NNM Toolbar.exe stack buffer overflow via OvOSLocale cookie
Hp · Network Node Manager
A stack-based buffer overflow exists in OvCgi/Toolbar.exe in HP OpenView Network Node Manager 7.01, 7.51 and 7.53, triggered by an overly long OvOSLocale cookie. It is a variant of CVE-2008-0067 and allows remote code execution against the affected web component.
Description
Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with a high EPSS score and public exploit reference, though the product is legacy and not in KEV.
What it is
A stack-based buffer overflow exists in OvCgi/Toolbar.exe in HP OpenView Network Node Manager 7.01, 7.51 and 7.53, triggered by an overly long OvOSLocale cookie. It is a variant of CVE-2008-0067 and allows remote code execution against the affected web component.
Impact
A remote attacker can execute arbitrary code in the context of the Toolbar.exe process, potentially gaining control of the NNM server. No privilege escalation beyond that process context is described in the record.
Attack surface
Reached over the network via HTTP requests to the OvCgi/Toolbar.exe CGI component, with the malicious payload carried in the OvOSLocale cookie. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.7494, 99.48th percentile) and a reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply the HP vendor patch for OpenView NNM 7.01, 7.51 and 7.53 as referenced in the vendor advisories.
- If patching is not immediately possible, restrict network access to the NNM web/CGI interface to trusted management hosts only.
- Disable or block access to OvCgi/Toolbar.exe if it is not required for operations.
- Monitor and filter HTTP requests containing abnormally long OvOSLocale cookie values at the perimeter or reverse proxy.
Detection
- Inspect web server and proxy logs for requests to OvCgi/Toolbar.exe with unusually long OvOSLocale cookie values.
- Alert on crashes or abnormal process termination of Toolbar.exe on NNM hosts.
- Monitor for unexpected child processes or command execution spawned by the NNM web/CGI service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-0920 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-0920), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
