CVE-2005-0771: VERITAS Backup Exec Server RPC interface allows unauthenticated registry modification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote access to an RPC interface that permits registry modification gives complete host compromise with a CVSS 2.0 score of 10 and a high EPSS percentile.

What it is

The VERITAS Backup Exec Server (beserver.exe) versions 9.0 through 10.0 for Windows exposes an RPC interface on TCP port 6106 that permits remote, unauthenticated callers to modify the Windows registry. Because the flaw is reachable over the network with no credentials and yields full confidentiality, integrity and availability impact, it is a severe pre-authentication remote compromise of the backup server host.

Impact

An attacker can alter registry keys on the Backup Exec server, which can subvert the service's configuration and, in practice, lead to full control of the host. The CVSS 2.0 vector (AV:N/AC:L/Au:N/C:C/I:C/A:C) rates the impact as complete across confidentiality, integrity and availability.

Attack surface

Reached remotely over the network via the RPC interface on TCP port 6106; the description states no authentication is required and no user interaction is mentioned. Any host that can route to port 6106 on a vulnerable Backup Exec server is a potential entry point.

Exploitation

The record does not list this CVE in CISA KEV and no ransomware usage is documented; EPSS is high at 0.54155 (98.9th percentile), and multiple references carry Patch and Vendor Advisory tags, indicating a fix exists but no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor patch referenced in the VERITAS/Symantec advisories and CERT/CC VU#584505 as the first action.
• Block or restrict TCP port 6106 to trusted management hosts only, using host firewalls or network ACLs.
• Isolate Backup Exec servers on a dedicated management segment so the RPC interface is not reachable from general user or internet-facing networks.
• If the affected 9.0-10.0 versions cannot be patched, upgrade to a supported Backup Exec release.
• Monitor and alert on unexpected registry changes on Backup Exec hosts.

Detection

• Monitor network flows for inbound connections to TCP port 6106 on Backup Exec servers from untrusted sources.
• Audit Windows registry change events on Backup Exec hosts and alert on modifications to Backup Exec service keys.
• Correlate beserver.exe process activity with unexpected registry writes or service configuration changes.
• Review Backup Exec server logs for anomalous RPC method invocations around the time of registry changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.