CVE-2010-1961: HP OpenView NNM ovutil.dll buffer overflow via jovgraph.exe

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 base score of 10 with network, unauthenticated, no-interaction exploitation and a high EPSS percentile, though no confirmed in-the-wild exploitation is recorded.

What it is

HP OpenView Network Node Manager 7.51 and 7.53 contain a buffer overflow in ovutil.dll, reached through jovgraph.exe, where unspecified variables are mishandled in a sprintf call. A remote, unauthenticated attacker can trigger memory corruption that may lead to arbitrary code execution on the affected server.

Impact

Successful exploitation allows remote code execution with the privileges of the ovwebsnmpsrv.exe process, giving an attacker full control of the affected host.

Attack surface

The flaw is network-reachable (AV:N) with no authentication (Au:N) and no user interaction, exploited by sending crafted input to jovgraph.exe that flows into ovutil.dll.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is high at roughly 0.67 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the HP vendor patch referenced in the Bugtraq advisory (marc.info bugtraq 127602909915281) to affected NNM 7.51/7.53 installations.
• If patching is not immediately possible, restrict network access to the NNM web/SNMP services (including jovgraph.exe) to trusted management hosts only.
• Run ovwebsnmpsrv.exe and related NNM services under a least-privileged account to limit post-exploitation impact.
• Monitor HP advisories for updated guidance and consider upgrading to a supported NNM release.
• Segment the NNM management network so a compromised node cannot reach other critical infrastructure.

Detection

• Monitor for crashes or abnormal termination of ovwebsnmpsrv.exe and jovgraph.exe processes on NNM hosts.
• Inspect HTTP requests to jovgraph.exe for unusually long or malformed parameter values that could overflow the sprintf buffer.
• Alert on unexpected child processes or command shells spawned by ovwebsnmpsrv.exe.
• Review network logs for scanning or exploit attempts against NNM web ports from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.