9.8Crítica
KEV
CVE-2005-2773HP OpenView Network Node Manager Remote Code Execution Vulnerability
Explotación conocida — HP OpenView Network Node Manager Remote Code Execution Vulnerability
CISA confirmó el 25.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.04.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2005-2773
Descripción
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
Debilidad (CWE):
CWE-77
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| hp | openview network node manager | 6.2 – ≤ 7.50 |
Referencias y parches
- 20050825 Portcullis Security Advisory 05-014 HP Openview Remote Command mailing-listExploitIssue TrackingMailing List
- hp-openview-node-manager-command-execution(21999) vdb-entryThird Party Advisory
- HPSBMA01224 vendor-advisoryBroken Link
- 14662 vdb-entryBroken Link
- 16555 third-party-advisoryNot Applicable
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2005-2773 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:hp:openview_network_node_manager:*:*:*:*:*:*:*:*≥ 6.2 ≤ 7.50