CVE-2009-4188: HP Operations Dashboard default j2deployer password enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityA hardcoded default credential gives unauthenticated remote attackers a direct path to arbitrary code execution with full impact, and EPSS predicts exploitation at the 99th percentile.

What it is

HP Operations Dashboard ships with a hardcoded default password of j2deployer for the j2deployer account. An attacker who authenticates with those credentials gains the manager role and can upload files to the /manager servlet in the Tomcat container, leading to arbitrary code execution. The flaw matters because it is remotely reachable, needs no special conditions, and grants full control of the host.

Impact

An attacker obtains the manager role and can upload and execute arbitrary files, resulting in full compromise of confidentiality, integrity and availability on the affected system.

Attack surface

Reachable over the network against the Tomcat /manager servlet; no prior authentication is required because the attacker simply uses the known default credentials, and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high at roughly 0.69 (99th percentile), indicating substantial predicted exploitation activity; the references carry no exploit tags.

What to do

• Change the default j2deployer password immediately, or disable the account if it is not required.
• Restrict network access to the Tomcat /manager servlet to trusted management hosts only.
• Upgrade or apply the vendor fix for HP Operations Dashboard if one is available for your version.
• Audit all default and shared credentials across the deployment and remove any that remain.
• Review Tomcat manager role assignments and remove unnecessary manager privileges.

Detection

• Monitor Tomcat and application logs for authentication as j2deployer, especially from unexpected source addresses.
• Alert on file uploads or PUT/POST activity against the /manager servlet.
• Watch for new or modified files in Tomcat web application directories and for unexpected process execution from those paths.
• Baseline normal manager-servlet access and flag off-hours or anomalous use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.