CVE-2010-1964: HP OpenView NNM ovwebsnmpsrv.exe buffer overflow via jovgraph.exe

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution on a network management server with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

A buffer overflow exists in ovwebsnmpsrv.exe in HP OpenView Network Node Manager 7.51 and 7.53, reachable through unspecified parameters passed to jovgraph.exe. Successful exploitation allows remote code execution on the affected NNM server, which is a high-value management host. The record gives no further detail on the exact parameter or overflow mechanism.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the vulnerable service, potentially gaining full control of the NNM host. Because NNM is a network management platform, compromise can expose managed infrastructure and credentials.

Attack surface

The flaw is network-reachable (AV:N) with no authentication required (Au:N) and low attack complexity (AC:L) per the CVSS 2.0 vector. No user interaction is indicated; the attacker targets the web/graph component (jovgraph.exe) that feeds ovwebsnmpsrv.exe.

Exploitation

The CVE is not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.661 (99.2nd percentile), indicating elevated likelihood of exploitation activity. A patch reference is present in the Bugtraq advisory.

What to do

• Apply the HP patch referenced in the Bugtraq advisory (seclists.org/bugtraq/2010/Jun/152) or upgrade to a supported NNM release.
• Restrict network access to NNM web and management interfaces to trusted administrative networks only.
• Run the NNM service under a least-privileged account to limit post-exploitation impact.
• Monitor for and block exploitation attempts against jovgraph.exe/ovwebsnmpsrv.exe at the perimeter or host firewall.
• If NNM 7.51/7.53 cannot be patched, isolate the host and treat it as end-of-life.

Detection

• Inspect web server and NNM logs for anomalous requests to jovgraph.exe with unusually long or malformed parameters.
• Monitor for crashes or restarts of ovwebsnmpsrv.exe, which may indicate failed overflow attempts.
• Alert on unexpected child processes spawned by ovwebsnmpsrv.exe or jovgraph.exe.
• Hunt for outbound connections from the NNM host to unfamiliar external addresses following web requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.