Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCent…

published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1386

cvss: 6.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 9.9%; EPSS 9.9% chance of exploitation in 30 days, percentile 95%
public exploits: 2; Metasploit, Exploit-DB

Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the bpjava-susvc process, possibly related to the call-back feature.

Patch / fix

links 3

ciac.org/ciac/bulletins/p-020.shtml advisory
kb.cert.org/vuls/id/685456 advisory
seer.support.veritas.com/docs/271727.htm advisory

Timeline

2004-10-21 First public exploit (Metasploit exploit/multi/misc/veritas_netbackup_cmdexec)
2004-12-31 Published

Exploit prediction

9.86% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/misc/veritas_netbackup_cmdexec VERITAS NetBackup Remote Command Execution metasploit exploit, excellent rank, 2004-10-21
EDB-9941 Veritas NetBackup - Remote Command Execution (Metasploit) remote, 2004-10-21

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.0	AV:L/AC:H/Au:S/C:C/I:C/A:C

References

ciac.org /ciac/bulletins/p-020.shtml
third-party-advisory, government-resource, patch, vendor-advisory
kb.cert.org /vuls/id/685456
third-party-advisory, patch, us-government-resource
seer.support.veritas.com /docs/271727.htm
patch, vendor-advisory
secunia.com /advisories/12901/
third-party-advisory, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/17811
vdb-entry
securityfocus.com /bid/11494
vdb-entry

Sources

CVE List CVE-2004-1389
NVD CVE-2004-1389

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary