CVE-2007-3216: CA BrightStor ARCserve LGServer buffer overflows allow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityPre-authentication remote buffer overflows with a CVSS 2.0 score of 10 and high EPSS probability allow full compromise of the backup server.

What it is

The LGServer component of CA BrightStor ARCserve Backup for Laptops and Desktops r11.1 contains multiple buffer overflows reachable through crafted arguments to dozens of rxs, rxc and rxr commands. Because the flaws are pre-authentication and network-reachable, they expose the backup server to remote code execution.

Impact

A remote attacker can execute arbitrary code with the privileges of the LGServer process, potentially taking full control of the backup server and the data it manages.

Attack surface

The vulnerability is reached over the network via the LGServer service (CVSS vector AV:N/AC:L/Au:N), so no authentication or user interaction is required. Any host that can reach the LGServer port can attempt exploitation.

Exploitation

The record shows no CISA KEV listing and no reference tags indicating a public exploit, though EPSS is high at 0.59193 (99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the vendor security updates referenced in the CA support notices for BrightStor ARCserve Backup for Laptops and Desktops r11.1.
• Restrict network access to the LGServer service to trusted management hosts using firewall rules or network segmentation.
• If the product is no longer supported, migrate to a maintained backup platform or isolate the server on a dedicated management VLAN.
• Monitor vendor advisories for updated patches and confirm the installed build against the fixed version.
• Disable or block the LGServer service if it is not required for current operations.

Detection

• Monitor LGServer traffic for malformed or oversized arguments to rxs*, rxc* and rxr* commands.
• Alert on unexpected process creation or crashes originating from the LGServer service process.
• Review network logs for connections to the LGServer port from hosts outside the expected management subnet.
• Correlate LGServer service crash events with subsequent suspicious process activity on the backup server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.