This vulnerability is a command injection flaw in the NVBULogDaemon JSON‑RPC interface of Quest NetVault Backup. A remote attacker can supply an unvalidated string that is incorporated into a system call, allowing execution of arbitrary code with SYSTEM privileges and providing full control of the affected host. The weakness is described as CWE‑78, which denotes unsafe handling of system commands.

The affected product is Quest NetVault Backup. No specific version information is provided in the CVE entry; however, the release notes for version 14.0.2 contain the fix, indicating that any earlier releases prior to 14.0.2 are vulnerable.

With a CVSS score of 8.8, the vulnerability is classified as high severity. The attacker requires authentication to access the NVBULogDaemon service, but the authentication mechanism can be bypassed, effectively allowing unauthenticated remote exploitation. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the potential to gain SYSTEM‑level access renders the risk significant and warrants immediate attention.