SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2009-0921

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and…

HIGH 10.0EPSS 13.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 13.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

CVSS 2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
13.24% probability · 96th percentile
CISA KEV
Not listed
Weakness
CWE-119
Affected
hp/network node manager
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.