CVE-2017-8859

In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root

published May 9, 2017

CVSS
—
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

🚨 Unauthenticated access to the Veritas NetBackup Appliance is like leaving your front door wide open — anyone can waltz in and take control! 🔥 Think of the NetBackup Appliance as a restaurant kitchen, where anyone without an apron and a reservation can simply walk in and start cooking — that’s the level of access this vulnerability allows! An attacker could execute any command as the root user, potentially compromising sensitive data or disrupting services entirely. This could lead to catastrophic consequences, including data loss and system downtime, which is absolutely devastating for any organization relying on this appliance.

Put simply

Think of the NetBackup Appliance as a restaurant kitchen, where anyone without an apron and a reservation can simply walk in and start cooking — that’s the level of access this vulnerability allows! This vulnerability occurs because the appliance does not properly authenticate users, allowing them to execute arbitrary commands as root, which could completely take control of the device.

What to do

An attacker could execute any command as the root user, potentially compromising sensitive data or disrupting services entirely. This could lead to catastrophic consequences, including data loss and system downtime, which is absolutely devastating for any organization relying on this appliance. To mitigate this risk, ensure you upgrade to the latest version of Veritas NetBackup Appliance provided by the vendor. Additionally, review your network access controls to restrict unauthenticated access and regularly audit user permissions. You've got this! With these steps, you'll strengthen your defenses and keep your systems secure. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02556 · 84.9th percentile
Published
2017-05-09T21:00Z
EPSS history
Timeline
  • 09 MAY 21:00Z
    In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root
    cvelistv5