CVE-2009-4179: HP OpenView Network Node Manager ovalarm.exe stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10 and very high EPSS probability makes this an urgent patching target despite the absence of KEV listing.

What it is

ovalarm.exe in HP OpenView Network Node Manager 7.01, 7.51 and 7.53 contains a stack-based buffer overflow reachable through a long HTTP Accept-Language header in an OVABverbose action. A remote, unauthenticated attacker can trigger it over the network, and the flaw is severe enough to allow arbitrary code execution on the affected host.

Impact

Successful exploitation lets a remote attacker execute arbitrary code with the privileges of the ovalarm.exe process, giving full compromise of confidentiality, integrity and availability on the NNM server.

Attack surface

The flaw is reached over the network via HTTP requests to ovalarm.exe, specifically a crafted Accept-Language header in an OVABverbose action. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.66973, 99.26th percentile), indicating strong likelihood of exploitation activity. Reference tags show only Patch and Vendor Advisory, with no public exploit tag supplied.

What to do

• Apply the HP vendor patch referenced in the HP support document (objectID=c01950877) and SecurityFocus BID 37261.
• If patching is not immediately possible, restrict network access to the NNM web/ovalarm.exe interface to trusted management hosts only.
• Place NNM management interfaces behind a firewall or VPN and avoid exposing them to untrusted networks.
• Monitor for and block HTTP requests containing oversized or malformed Accept-Language headers targeting ovalarm.exe.
• Retire or isolate end-of-life NNM 7.x deployments that can no longer receive vendor fixes.

Detection

• Inspect web/proxy logs for requests to ovalarm.exe with unusually long Accept-Language headers or OVABverbose parameters.
• Alert on ovalarm.exe process crashes or abnormal termination on NNM hosts, which may indicate exploitation attempts.
• Monitor for unexpected child processes or outbound connections spawned by ovalarm.exe.
• Use network IDS signatures for the TippingPoint advisory TPTI-09-12 pattern against NNM HTTP traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.