The vulnerability is a classic SQL injection in the NVBURemovableMedia JSON‑RPC handler where a user supplied string is concatenated directly into a SQL query without validation. If exploited, the attacker can run arbitrary code on the server process with the privileges of the NETWORK SERVICE account, giving them full control over the system. The weakness is identified as CWE‑89 and carries a CVSS score of 8.8, indicating high severity.

Quest NetVault Backup installations are affected. No specific version range is provided in the data, but the referenced release notes point to version 14.0.2, suggesting earlier releases may also be vulnerable.

An attacker must reach the target machine and be able to send authenticated JSON‑RPC traffic, but the existing authentication can be bypassed. Because the vulnerability can be triggered remotely, a malicious actor can execute code without local access. The EPSS score is not available, and the issue is not listed in CISA KEV, so while exploitation risk is not quantified, the high CVSS and remote code execution nature warrant immediate attention.