CVE-2009-0921: HP Network Node Manager

High severity, CVSS 10.0. EPSS: 13.2% chance of exploitation in the next 30 days.

Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.

Affected products

• HP Network Node Manager: version 7.0.1 only; version 7.5.1 only; version 7.5.3 only

Published 2009-03-25. Last modified 2026-06-16.