Remote Code Execution in HP OpenView Network Node Manager (CVE‑2005‑2773) Threatens Enterprise Network Management
What It Is
CVE‑2005‑2773 is a remote code execution (RCE) flaw in Hewlett Packard’s OpenView Network Node Manager (OVN NM). The vulnerability allows an unauthenticated attacker to inject and run arbitrary operating‑system commands on the management server, potentially compromising the entire monitoring infrastructure.
Exploitability
The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Public proof‑of‑concept code has been circulated for years, and the CVSS base score is rated High (8.8). No vendor‑issued patch exists for legacy installations that remain unpatched.
Affected Products
- Vendor: Hewlett Packard (HP)
- Product: OpenView Network Node Manager (all versions prior to the end‑of‑life deprecation)
Why It Matters for Compliance & Audit Readiness
Continuous control monitoring requires evidence that critical management systems are protected against unauthenticated code execution. An exploited RCE in OVN NM undermines the access‑control domain of frameworks such as NIST CSF and ISO 27001, eroding the trust you can demonstrate to auditors. Documenting remediation steps—patching, segmentation, or removal—creates a defensible audit trail and satisfies vendor‑management controls that demand up‑to‑date security baselines for third‑party software.
Recommended Actions
- Map the control: Align the vulnerability with your organization’s “Remote Execution Prevention” control (e.g., NIST PR.IP‑1).
- Capture evidence: Record current OVN NM version, patch status, and network segmentation diagrams.
- Validate posture: Run authenticated scans (e.g., Nessus, Qualys) to confirm the presence or remediation of CVE‑2005‑2773.
- Apply mitigations: If patching is impossible, isolate the manager on a restricted VLAN, enforce strict firewall rules, and enable multi‑factor authentication for any administrative access.
- Update vendor‑risk register: Document the risk, remediation timeline, and residual risk for audit reviewers.
Source: CISA KEV – CVE‑2005‑2773