CVE-2010-1554: HP OpenView Network Node Manager getnnmdata.exe stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, full confidentiality/integrity/availability impact, and publicly available exploit code make this an urgent patching priority.

What it is

A stack-based buffer overflow exists in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53, triggered by an invalid iCount parameter. Because the flaw is remotely reachable and yields full code execution, it is a serious risk to unpatched NNM deployments.

Impact

A remote attacker can execute arbitrary code on the affected NNM host, gaining full control of the service and potentially the underlying system. This can lead to data compromise, service disruption, and use of the host as a pivot into the network.

Attack surface

The vulnerability is reached over the network through getnnmdata.exe, per the AV:N vector, and requires no authentication (Au:N) and no user interaction. Any host that can reach the NNM service can attempt the attack.

Exploitation

No CISA KEV listing is present, but EPSS is high (0.65921, 99.236th percentile) and a public Exploit-DB entry (14181) exists, indicating exploit code is publicly available. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the HP vendor patch for OV NNM 7.01, 7.51, and 7.53 as soon as possible; this is the primary fix.
• If patching is not immediately possible, restrict network access to the NNM service (getnnmdata.exe) to trusted management hosts only.
• Place NNM behind a firewall or ACL and avoid exposing it to untrusted networks or the internet.
• Monitor vendor advisories and consider upgrading to a supported NNM release if 7.x is end-of-life.
• Validate and sanitize the iCount parameter at any proxy or filtering layer if one is in front of the service.

Detection

• Inspect NNM/web server logs for requests to getnnmdata.exe with abnormal or oversized iCount parameter values.
• Monitor for crashes or restarts of getnnmdata.exe or the NNM service, which may indicate exploitation attempts.
• Use network IDS/IPS signatures for buffer overflow patterns targeting getnnmdata.exe and review alerts for the known Exploit-DB PoC.
• Watch for unexpected child processes or outbound connections originating from the NNM host after getnnmdata.exe activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.