CVE-2005-1009: BakBone NetVault buffer overflows allow remote and local code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10 and public exploit references, though no KEV listing.

What it is

BakBone NetVault 6.x and 7.x contain multiple buffer overflows. A remote attacker can trigger a heap-based overflow via a modified computer name and length, and a local user can overflow a buffer via a long Name entry in configure.cfg. Both paths lead to arbitrary code execution, making this a serious flaw in the backup server software.

Impact

An unauthenticated remote attacker can execute arbitrary code on the NetVault server, and a local user can do the same through the configuration file. Successful exploitation gives full control of the affected host, consistent with the CVSS 2.0 score of 10.

Attack surface

The remote vector is network-reachable with no authentication required (AV:N/AC:L/Au:N), and the local vector requires access to the configure.cfg file. No user interaction is indicated by the description or vector.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.57017 (99th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor patch or upgrade to a fixed NetVault release; the record does not specify affected or fixed versions, so confirm with BakBone/Quest support.
• Restrict network access to NetVault services to trusted management hosts only.
• Limit local filesystem access to configure.cfg to authorized administrators.
• Monitor vendor advisories for updated guidance since the record is old and marked Modified.

Detection

• Monitor NetVault process crashes or abnormal terminations that may indicate overflow attempts.
• Alert on unexpected modifications to configure.cfg, especially unusually long Name values.
• Watch for suspicious child processes spawned by NetVault services.
• Review network traffic to NetVault ports for malformed or oversized computer name fields.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.