CVE-2009-0920

HP Network Node Manager 7.01, 7.51, 7.53 - Stack-Based Buffer Overflow via OvOSLocale Cookie

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2009-0920. PoCs published by Metasploit, Oren Isacson, juan vazquez, including Metasploit module exploits/windows/http/hp_nnm_toolbar_02.

AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in HP OpenView Network Node Manager by sending a maliciously crafted OvOSLocale cookie to Toolbar.exe, allowing arbitrary code execution. It includes targets for both NNM 7.0 and 7.53_01195 with specific bad character handling and alignment techniques.

Description

Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/17537

This Metasploit module exploits a stack buffer overflow in HP OpenView Network Node Manager by sending a maliciously crafted OvOSLocale cookie to Toolbar.exe, allowing arbitrary code execution. It includes targets for both NNM 7.0 and 7.53_01195 with specific bad character handling and alignment techniques.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HP OpenView Network Node Manager 7.0 and 7.53_01195
No auth needed
Prerequisites: Network access to the target's Toolbar.exe CGI endpoint · Target must be running a vulnerable version of HP OpenView Network Node Manager
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Oren Isacson, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_nnm_toolbar_02.rb

This Metasploit module exploits a stack buffer overflow in HP OpenView Network Node Manager via a maliciously crafted OvOSLocale cookie. It targets specific builds (7.0 and 7.53_01195) to achieve remote code execution by overwriting EIP and aligning registers for shellcode execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HP OpenView Network Node Manager 7.0 and 7.53 Patch 01195
No auth needed
Prerequisites: Network access to the target's Toolbar.exe CGI endpoint · Target must be running a vulnerable version of HP OpenView Network Node Manager
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0819
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34294
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8308
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502054/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34444
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49364
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=123791084113871&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021883

Scores

EPSS 0.7494
EPSS Percentile 99.4%

Details

CWE
CWE-119
Status published
Products (3)
hp/network_node_manager 7.0.1
hp/network_node_manager 7.5.1
hp/network_node_manager 7.5.3
Published Mar 25, 2009
Tracked Since Feb 18, 2026