CVE-2020-37045
Published: 01 February 2026
Summary
CVE-2020-37045 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Veritas NetBackup (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2020-37045 is an unquoted service path vulnerability in Veritas NetBackup 7.0, specifically affecting the NetBackup INET Daemon service executable at C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe. This flaw, classified under CWE-428, arises from the service path lacking proper quotation marks, enabling local users to potentially execute arbitrary code by exploiting how Windows resolves unquoted paths.
Local low-privileged users (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N). By placing a malicious executable in a directory that the service searches before reaching the legitimate binary, attackers can achieve code execution with elevated LocalSystem privileges, resulting in high impacts to confidentiality, integrity, and availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8).
Advisories, including those from VulnCheck on the NetBackup INET Daemon unquoted service path and Veritas, provide details on the issue, while an exploit is publicly available on Exploit-DB. Security practitioners should refer to these sources and the vendor site for patch information and mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30972
Vulnerability details
Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that would execute…
more
with elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in NetBackup INET Daemon directly enables Path Interception by Unquoted Path for local privilege escalation to LocalSystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path vulnerability in the NetBackup INET Daemon by applying vendor patches to correct the service executable path registration.
Enforces secure configuration settings for services, including proper quoting of executable paths to mitigate exploitation of unquoted paths like that in bpinetd.exe.
Applies least privilege to file system directories in the service path, preventing low-privileged local users from placing malicious executables in exploitable locations.