Exploitation Summary
CVE-2005-2773 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022.
EIP tracks 3 public exploits from researchers including Metasploit, Lympex, including a Metasploit module exploits/unix/webapp/openview_connectednodes_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in HP OpenView's connectedNodes.ovpl CGI application by injecting arbitrary commands via the 'node' parameter. The payload is executed on the target system, and the output is captured and displayed.
Description
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in HP OpenView's connectedNodes.ovpl CGI application by injecting arbitrary commands via the 'node' parameter. The payload is executed on the target system, and the output is captured and displayed.
This exploit targets HP OpenView Network Node Manager (NNM) versions 6.2, 6.4, 7.01, and 7.50 by sending a crafted HTTP GET request to the '/OvCgi/connectedNodes.ovpl' endpoint with a command injection payload. The vulnerability allows remote command execution due to improper input validation in the 'node' parameter.
This Metasploit module exploits a command injection vulnerability in HP OpenView's connectedNodes.ovpl CGI application by injecting arbitrary commands via the 'node' parameter. The payload is executed on the target system, and the output is captured and displayed.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H