CVE-2009-4189: HP Operations Manager default ovwebusr password enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote code execution through default credentials, and the very high EPSS score indicates active exploitation risk.

What it is

HP Operations Manager ships with a default password of OvW*busr1 for the ovwebusr account. An attacker who uses that account with the manager role can reach the /manager servlet in the Tomcat container and perform unrestricted file uploads, leading to arbitrary code execution.

Impact

A remote attacker gains the manager role and can upload and execute arbitrary files, effectively taking full control of the affected server.

Attack surface

Reachable over the network via the Tomcat /manager servlet; no authentication is needed beyond the known default credentials, and no user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.785 (99.6th percentile), indicating strong likelihood of exploitation activity.

What to do

• Change the ovwebusr default password immediately and audit all HP Operations Manager service accounts for other default credentials.
• Apply the vendor patch or upgrade to a fixed HP Operations Manager release.
• Restrict network access to the Tomcat /manager servlet and the Operations Manager web interface to trusted management networks.
• Disable or remove the Tomcat manager application if it is not required for operations.
• Monitor and alert on file uploads to the /manager servlet and on unexpected file creation in web-accessible directories.

Detection

• Search web server and Tomcat logs for requests to /manager with file upload parameters or PUT/POST bodies.
• Alert on successful authentication to ovwebusr, especially from unexpected source IPs or outside maintenance windows.
• Monitor for new or modified files in Tomcat web application directories and for child processes spawned by the Tomcat service.
• Correlate HP Operations Manager authentication events with subsequent file writes or command execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.