CVE-2011-0267: HP OpenView Network Node Manager nnmRptConfig.exe buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a 10.0 CVSS score and very high EPSS, though not in KEV.

What it is

HP OpenView Network Node Manager 7.51 and 7.53 contain multiple buffer overflows in nnmRptConfig.exe, reachable through long schdParams or nameParams parameters. Successful exploitation allows remote code execution on the NNM server, which is a high-value management host. The record does not state whether a patch exists or which fixed version applies.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the nnmRptConfig.exe process, giving full control of the affected NNM server. The CVSS 2.0 vector rates complete confidentiality, integrity and availability loss.

Attack surface

Reached over the network via HTTP requests to the nnmRptConfig.exe CGI component, per the AV:N vector. The vector shows no authentication (Au:N) and no user interaction requirement.

Exploitation

Not listed in CISA KEV, but EPSS is 0.7166 (99.4th percentile) and public references include an Exploit-DB entry and a Zero Day Initiative advisory, indicating exploit code and technical detail are publicly available.

What to do

• Apply the HP patch for nnmRptConfig.exe buffer overflows; the record does not name a fixed version, so confirm the current vendor advisory before upgrading.
• If NNM 7.51/7.53 cannot be patched promptly, restrict network access to the NNM web/CGI interface to trusted management networks only.
• Place the NNM server behind a reverse proxy or WAF that rejects oversized schdParams and nameParams values.
• Run the NNM service under a least-privilege account so code execution does not yield full host control.
• Monitor for and retire end-of-life NNM 7.x deployments, since this is a 2011-era flaw.

Detection

• Inspect web server and NNM logs for requests to nnmRptConfig.exe with unusually long schdParams or nameParams values.
• Alert on nnmRptConfig.exe spawning child processes such as cmd.exe or shells, which is abnormal for a reporting CGI.
• Monitor for crash or restart events in nnmRptConfig.exe that may indicate failed overflow attempts.
• Hunt for outbound connections or new files originating from the NNM server host after CGI requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.