Vulnerability record · CVE-2010-1960 · published 10 June 2010
CVE-2010-1960: HP OpenView NNM ovwebsnmpsrv.exe buffer overflow via jovgraph.exe option
Hp · Openview Network Node Manager
A buffer overflow exists in the error handling functionality of ovwebsnmpsrv.exe in HP OpenView Network Node Manager 7.51 and 7.53. A remote attacker can trigger it by sending a long, invalid option to jovgraph.exe, which can lead to arbitrary code execution on the affected host.
Description
Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long, invalid option to jovgraph.exe.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe CVSS 2.0 score is 10.0 (network, no auth, full C/I/A) and EPSS is very high, but there is no KEV listing or documented in-the-wild exploitation.
What it is
A buffer overflow exists in the error handling functionality of ovwebsnmpsrv.exe in HP OpenView Network Node Manager 7.51 and 7.53. A remote attacker can trigger it by sending a long, invalid option to jovgraph.exe, which can lead to arbitrary code execution on the affected host.
Impact
Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code with the privileges of the vulnerable service, potentially leading to full compromise of the NNM host.
Attack surface
The flaw is reachable over the network via the affected service (AV:N, AC:L, Au:N), so no authentication or user interaction is required. The attack is delivered by supplying a long, invalid option to jovgraph.exe.
Exploitation
The record does not list this CVE in CISA KEV and no ransomware usage is documented; EPSS shows a high 30-day probability (0.67319, 99.269th percentile), and references include vendor patch and advisory links but no public exploit tag.
What to do
- Apply the HP vendor patch referenced in the bugtraq advisory (marc.info bugtraq 127602909915281) as the first action.
- Restrict network access to the NNM service and jovgraph.exe/ovwebsnmpsrv.exe to trusted management hosts only.
- If patching is not immediately possible, disable or block the affected service until the fix is applied.
- Monitor HP and ZDI advisories for updated guidance and any revised patches.
Detection
- Monitor service logs and process crashes for ovwebsnmpsrv.exe and jovgraph.exe, especially abnormal termination or error-handling failures.
- Inspect network traffic to the NNM service for unusually long or malformed option strings targeting jovgraph.exe.
- Alert on unexpected child processes or command execution spawned by ovwebsnmpsrv.exe or jovgraph.exe.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-1960 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-1960), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
