Vulnerability record · CVE-2018-1161 · published 8 February 2018
CVE-2018-1161: Quest NetVault Backup nvwsworker.exe stack buffer overflow
Quest · Netvault Backup
Quest NetVault Backup 11.2.0.13 contains a stack-based buffer overflow in nvwsworker.exe when it parses the boundary header of a multipart request, because the length of user-supplied data is not validated before being copied to a stack buffer. The flaw is remotely reachable without authentication and allows code execution as SYSTEM, making it a severe pre-auth risk for exposed backup servers.
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart request, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4215.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication and SYSTEM-level code execution makes this a top-priority pre-auth remote code execution flaw.
What it is
Quest NetVault Backup 11.2.0.13 contains a stack-based buffer overflow in nvwsworker.exe when it parses the boundary header of a multipart request, because the length of user-supplied data is not validated before being copied to a stack buffer. The flaw is remotely reachable without authentication and allows code execution as SYSTEM, making it a severe pre-auth risk for exposed backup servers.
Impact
An unauthenticated remote attacker can execute arbitrary code with SYSTEM privileges on the affected NetVault Backup installation, giving full control of the backup server and any data or credentials it manages.
Attack surface
The vulnerability is reached over the network through a multipart request handled by nvwsworker.exe; per the description, no authentication is required and no user interaction is indicated by the CVSS vector (AV:N/PR:N/UI:N).
Exploitation
The record shows no CISA KEV listing and no public exploit references beyond the ZDI advisory, but EPSS is high at roughly 0.667 (99.25th percentile), indicating elevated predicted exploitation activity.
What to do
- Upgrade Quest NetVault Backup to a version that fixes the nvwsworker.exe boundary-header overflow; the record does not state which version contains the fix, so confirm with Quest.
- Restrict network access to the NetVault Backup service and nvwsworker.exe ports to trusted management hosts only.
- Place exposed backup servers behind a firewall or VPN and avoid direct internet exposure.
- Monitor Quest advisories and apply vendor patches promptly for this and related NetVault flaws.
Detection
- Inspect NetVault Backup and nvwsworker.exe logs for crashes or abnormal termination tied to multipart request handling.
- Monitor network traffic to the NetVault service for malformed or oversized multipart boundary headers.
- Watch for unexpected child processes or SYSTEM-level activity spawned by nvwsworker.exe on backup servers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://zerodayinitiative.com/advisories/ZDI-18-004 | Third Party AdvisoryVDB Entry |
| https://zerodayinitiative.com/advisories/ZDI-18-004 | Third Party AdvisoryVDB Entry |
Track CVE-2018-1161 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-1161), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
