HP OpenView Network Node Manager Remote Command Execution (CVE-2005-2773)
Executive & SecOps Summary
SECOPS ASSESSMENTHP OpenView Network Node Manager (NNM) versions 6.2 through 7.50 are affected.
Remote attackers can execute arbitrary system commands with web server privileges without authentication by injecting shell metacharacters into vulnerable OVPL scripts.
Restrict external access to the vulnerable OVPL scripts immediately and apply official vendor patches or upgrade to a supported version.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches provided by HP or upgrade to a supported, non-vulnerable version of Network Node Manager. For legacy environments, install the appropriate patch depot as shown below:
# Example of installing a patch depot on HP-UX (Replace with the actual patch ID)
swinstall -s /var/spool/sw/PHSS_33138.depot PHSS_331382. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the vulnerable .ovpl scripts within the web server configuration (e.g., Apache HTTPD) to authorized IP addresses only.
# Apache HTTPD configuration workaround to restrict access
<FilesMatch '^(connectedNodes|cdpView|freeIPaddrs|ecscmg)\.ovpl$'>
Order Deny,Allow
Deny from all
Allow from 10.0.0.0/8
</FilesMatch>3. Log Audit & IoC Verification Commands
Scan the web server access logs to identify potential exploitation attempts targeting the vulnerable OVPL scripts with shell metacharacters.
# Search Apache access logs for suspicious requests containing shell metacharacters in OVPL parameters
egrep -i '(connectedNodes|cdpView|freeIPaddrs|ecscmg)\.ovpl' /var/log/httpd/access_log | grep -E '(%3b|%7c|%60|;|\||`)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is an input validation failure (CWE-77) in the web-based reporting and management interface of HP OpenView Network Node Manager (NNM). Multiple OVPL CGI scripts, including connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl, and ecscmg.ovpl, fail to properly sanitize or escape user-supplied parameters (such as the node parameter) before passing them to system shell execution functions.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP GET or POST request to the vulnerable OVPL scripts. By appending shell metacharacters such as semicolons (;), pipes (|), or backticks (` `) followed by arbitrary system commands to the node parameter, the input is directly interpreted and executed by the underlying system shell (/bin/sh or cmd.exe`). This allows remote, unauthenticated command execution under the security context of the web server process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise infrastructure. Successful exploitation grants the attacker full control over the network management system, which can be leveraged as a pivot point to perform lateral movement, compromise internal network segments, and exfiltrate sensitive infrastructure data.
Official Vendor Advisories & References
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
Frequently Asked SecOps Questions (CVE-2005-2773)
FAQQ1. How critical is CVE-2005-2773 and is it actively exploited in the wild?
CVE-2005-2773 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 74.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2005-2773?
Primary impacted vendors include hp across openview network node manager. Scope summary: HP OpenView Network Node Manager (NNM) versions 6.2 through 7.50
Q3. What temporary mitigations or workarounds exist for CVE-2005-2773 before patching?
[Mitigation] Restrict external access to the vulnerable OVPL scripts immediately and apply official vendor patches or upgrade to a supported version. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2005-2773
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (hp)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.