CVE-2020-37045: 
Veritas NetBackup Client vulnerability analysis and mitigation

CVE-2020-37045 is an unquoted service path vulnerability in Veritas NetBackup 7.0 affecting the NetBackup INET Daemon (bpinetd) service on Windows. The flaw allows local users with low privileges to potentially execute arbitrary code with LocalSystem privileges by placing a malicious executable in a path that Windows resolves before the intended service binary. It was formally published on February 1, 2026, and assigned by VulnCheck. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (VulnCheck Advisory, Exploit-DB).

The root cause is classified as CWE-428 (Unquoted Search Path or Element). When the NetBackup INET Daemon service is registered with the unquoted path C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe, Windows' service control manager attempts to resolve the path by trying shorter path segments first — for example, C:\Program.exe or C:\Program Files\Veritas.exe — before reaching the intended binary. A local attacker with write access to any of these intermediate directories can place a malicious executable at one of those locations, which will then be executed with LocalSystem privileges when the service starts or restarts. No network access or user interaction is required; only low-privilege local access is needed (VulnCheck Advisory, Exploit-DB, Infinitsec Blog).

Successful exploitation grants the attacker code execution under the LocalSystem account, which is the highest privilege level on a Windows system. This results in full confidentiality, integrity, and availability compromise of the affected host, enabling the attacker to install backdoors, exfiltrate sensitive backup data managed by NetBackup, disable security controls, or use the compromised system as a pivot point for lateral movement within the network. Given that NetBackup servers typically have access to enterprise-wide backup data, the potential for sensitive data exposure is significant (VulnCheck Advisory).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-ID 48227), lowering the barrier for exploitation (Exploit-DB). The EPSS score is approximately 0.012% (0.000120), indicating a currently low probability of widespread automated exploitation. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, which limits the attack surface compared to remotely exploitable vulnerabilities.

1. Reconnaissance: Gain local access to the target Windows system running Veritas NetBackup 7.0. Enumerate installed services and their binary paths using sc qc bpinetd or wmic service get name,pathname,startmode | findstr /i "netbackup" to confirm the unquoted path.
2. Identify exploitable path segment: Determine which intermediate path (e.g., C:\Program.exe or C:\Program Files\Veritas.exe) is writable by the current low-privilege user using icacls or similar tools.
3. Craft malicious executable: Compile or obtain a malicious payload (e.g., a reverse shell or privilege escalation binary) and name it to match the exploitable path segment (e.g., Program.exe).
4. Place the payload: Copy the malicious executable to the writable intermediate directory (e.g., C:\Program.exe).
5. Trigger service restart: Wait for the system to reboot, or trigger a service restart via sc stop bpinetd && sc start bpinetd if the attacker has sufficient permissions, or wait for a scheduled restart.
6. Achieve LocalSystem execution: Windows resolves the unquoted path and executes the malicious binary with LocalSystem privileges, granting full system control (Exploit-DB, Infinitsec Blog).

• File System: Unexpected executables in root or intermediate directories such as C:\Program.exe, C:\Program Files\Veritas.exe, or C:\Program Files\Veritas\NetBackup.exe; newly created or modified files in directories along the NetBackup service path.
• Process: Unusual processes spawned by the Windows Service Control Manager (services.exe) with LocalSystem privileges that are not the expected bpinetd.exe; unexpected child processes of services.exe such as cmd.exe, powershell.exe, or network tools.
• Logs: Windows System Event Log entries (Event ID 7036 or 7045) showing unexpected service state changes for the NetBackup INET Daemon; Windows Security Event Log entries (Event ID 4688) showing new process creation with LocalSystem context from unexpected executables.
• Registry: Changes to the service registry key HKLM\SYSTEM\CurrentControlSet\Services\NetBackup INET Daemon or its ImagePath value.

The primary remediation is to update the service registration to use a properly quoted binary path, enclosing the full path in double quotes: "C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe". Administrators should verify and correct the service path via the Windows registry at HKLM\SYSTEM\CurrentControlSet\Services\NetBackup INET Daemon by setting the ImagePath value to the quoted path. Additionally, restrict write permissions on directories in the service path (e.g., C:\, C:\Program Files\, C:\Program Files\Veritas\) to prevent non-administrative users from placing executables there. Check with Veritas for an official patch or updated installer that corrects the service registration (VulnCheck Advisory, Veritas).