CVE-2007-5289: HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scr...

Security readout for executives and security teams

HP Mercury Quality Center 9.2 and earlier depended on cached client-side scripts for workflow and user capability decisions. The CVE says an attacker could tamper with those scripts and use the OTA API to execute arbitrary code. This matters mainly for organizations still running old Quality Center or possibly TestDirector deployments. Exposure is likely limited to legacy HP Mercury Quality Center 9.2 or earlier environments, and possibly TestDirector. Internet exposure is not established in the provided sources. Risk is higher where OTA API access is available to untrusted or low-privileged users. Prioritize if legacy Quality Center remains in use for regulated testing, release approval, or defect workflows. The age of the product and incomplete fix data make exposure discovery the first decision point; unsupported systems should be removed or isolated. Mitigation focus: Inventory HP Mercury Quality Center and possible TestDirector installations.; Check HP vendor guidance for supported fixes, upgrades, or compensating controls.; Restrict OTA API access to trusted users and networks..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.