A flaw in the handling of NVBUDeviceDrive JSON‑RPC messages in Quest NetVault Backup allows an attacker to inject SQL statements. The lack of input validation enables a malicious user to execute arbitrary queries, leading to remote code execution. Because the authentication mechanism can be bypassed, an attacker does not need valid credentials, and any successful attack runs with NETWORK SERVICE privileges.

Quest NetVault Backup installations are affected. The vulnerability is tied to the NVBUDeviceDrive component; specific product versions are not listed in the advisory but the recommendation is to apply any security patch or update available from Quest.

The CVSS score of 8.8 highlights a high impact and medium-to-high complexity. No EPSS score is provided, but the vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require remote access to the JSON‑RPC interface, but authentication can be bypassed, which increases the likelihood of successful attacks. Once exploited, code runs with SYSTEM‑level privileges, allowing full compromise of the affected host.