CVE-2014-2624: HP Network Node Manager i remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with complete confidentiality, integrity and availability impact over the network without authentication, and EPSS is in the 99th percentile.

What it is

HP Network Node Manager i (NNMi) versions 9.0x, 9.1x and 9.2x contain an unspecified vulnerability that lets remote attackers execute arbitrary code. The record gives no root cause, affected component or attack vector detail beyond the CVSS vector, so the exact mechanism is unknown. It matters because NNMi is a network management platform, and code execution there can expose broad infrastructure visibility and control.

Impact

An attacker can run arbitrary code on the NNMi server, gaining the privileges of that service. Given the product's role, that access can be leveraged against managed network devices and data.

Attack surface

The CVSS 2.0 vector AV:N/AC:L/Au:N/C:C/I:C/A:C indicates the flaw is reachable over the network with no authentication and no user interaction. The specific interface or protocol is not stated in the record.

Exploitation

The CVE is not listed in CISA KEV and no reference carries an exploit tag, but EPSS is high at 0.65435 (99.2nd percentile), suggesting elevated likelihood of attempted exploitation. No public exploit details are provided in the record.

What to do

• Apply the HP security bulletin fix referenced in the advisory (emr_na-c04378450) or upgrade NNMi to a supported, patched release.
• Restrict network access to NNMi management interfaces to trusted administrative networks and hosts.
• Place NNMi behind firewall rules and segmentation so it is not reachable from untrusted networks.
• Monitor HP advisories for updated guidance since the vulnerability details are unspecified.
• If patching is delayed, consider isolating the NNMi server and limiting its credentials and reach into managed devices.

Detection

• Monitor NNMi server logs and host process activity for unexpected child processes or command execution spawned by the NNMi service.
• Alert on anomalous inbound connections to NNMi management ports from untrusted source addresses.
• Baseline normal NNMi network behavior and flag deviations such as new outbound connections to unusual destinations.
• Review file integrity on NNMi application and configuration paths for unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.