CVE-2009-3849: HP OpenView Network Node Manager stack buffer overflow via Template and Oid parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with a network, unauthenticated, no-interaction vector and very high EPSS probability make this a top-priority exposure for any unpatched NNM 7.x host.

What it is

HP OpenView Network Node Manager 7.01, 7.51 and 7.53 contain multiple stack-based buffer overflows in nnmRptConfig.exe (long Template parameter, strcat-related) and snmp.exe (long Oid parameter). A remote, unauthenticated attacker can trigger the overflows and execute arbitrary code on the affected server. The flaw is remotely reachable and rated maximum severity by the CVSS 2.0 vector.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the vulnerable NNM service, typically a privileged network management process. That yields full compromise of confidentiality, integrity and availability of the host.

Attack surface

Reached over the network via requests to the NNM web/management components handling nnmRptConfig.exe and snmp.exe; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The description does not specify which ports or protocols beyond the named executables.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.73694, 99.4th percentile), indicating substantial predicted exploitation activity. References include Zero Day Initiative advisories, which is consistent with public vulnerability research, though the record does not state that a working exploit is publicly available.

What to do

• Apply the HP vendor patch referenced in the HP support document (objectID=c01950877) as the first action.
• If patching is not immediately possible, restrict network access to NNM management interfaces and the affected executables to trusted administrative hosts only.
• Place NNM behind a firewall or management VLAN so untrusted networks cannot reach nnmRptConfig.exe or snmp.exe endpoints.
• Retire or isolate end-of-life NNM 7.01/7.51/7.53 installations that can no longer be patched.
• Monitor and alert on anomalous process crashes or restarts of nnmRptConfig.exe and snmp.exe as a possible exploitation signal.

Detection

• Monitor for crashes, abnormal termination or restart of nnmRptConfig.exe and snmp.exe processes on NNM hosts.
• Inspect HTTP/management traffic to NNM for unusually long Template or Oid parameter values.
• Alert on unexpected child processes or command execution spawned by NNM service processes.
• Review NNM host logs and network flows for connections from untrusted sources to management ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.