9.8Critical
KEV
CVE-2005-2773HP OpenView Network Node Manager Remote Code Execution Vulnerability
Known exploited — HP OpenView Network Node Manager Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 25.03.2022. Remediation deadline for US federal agencies: 15.04.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2005-2773
Description
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
Weakness (CWE):
CWE-77
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| hp | openview network node manager | 6.2 – ≤ 7.50 |
References and patches
- 20050825 Portcullis Security Advisory 05-014 HP Openview Remote Command mailing-listExploitIssue TrackingMailing List
- hp-openview-node-manager-command-execution(21999) vdb-entryThird Party Advisory
- HPSBMA01224 vendor-advisoryBroken Link
- 14662 vdb-entryBroken Link
- 16555 third-party-advisoryNot Applicable
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2005-2773 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:hp:openview_network_node_manager:*:*:*:*:*:*:*:*≥ 6.2 ≤ 7.50