Vulnerability record · CVE-2009-2685 · published 6 November 2009
CVE-2009-2685: HP Power Manager login form stack buffer overflow
Hp · Power Manager
The login form of the management web server in HP Power Manager contains a stack-based buffer overflow reachable through the Login variable. A remote, unauthenticated attacker can overwrite stack memory and execute arbitrary code on the host running the management service. Because the service is administrative and network-exposed, compromise gives full control of the affected system.
Description
Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10 and very high EPSS probability makes this an urgent exposure for any internet- or broadly reachable Power Manager instance.
What it is
The login form of the management web server in HP Power Manager contains a stack-based buffer overflow reachable through the Login variable. A remote, unauthenticated attacker can overwrite stack memory and execute arbitrary code on the host running the management service. Because the service is administrative and network-exposed, compromise gives full control of the affected system.
Impact
An attacker gains remote code execution with the privileges of the management web server, which the CVSS 2.0 vector rates as complete loss of confidentiality, integrity and availability. This effectively hands over the underlying host.
Attack surface
Reached over the network via HTTP against the management web server's login form; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. Any host that can reach the management interface can attempt the overflow.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.767, 99.5th percentile), indicating substantial predicted exploitation activity. Reference tags are limited to vendor advisories, so no public exploit code is confirmed by this record.
What to do
- Apply the HP vendor patch or upgrade to a fixed Power Manager release; treat this as the first action.
- Restrict network access to the Power Manager management web server to trusted administrative networks only.
- Place the management interface behind a firewall or VPN and block direct internet exposure of the login port.
- If the product is end-of-life or unsupported, migrate to a maintained management platform or decommission the service.
- Monitor and rate-limit repeated requests to the login endpoint as a compensating control.
Detection
- Inspect web server and application logs for oversized or malformed values in the Login parameter of the login form.
- Alert on crashes or restarts of the Power Manager management service, which may indicate failed overflow attempts.
- Monitor for unexpected child processes or outbound connections originating from the Power Manager host.
- Use network IDS signatures for long POST bodies or anomalous payloads directed at the login endpoint.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-2685 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-2685), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
