CVE-2020-36163

CVE-2020-36163 is a privilege escalation vulnerability affecting Veritas NetBackup and OpsCenter through version 8.3.0.1 on Windows systems. Low-privileged users can execute arbitrary code as SYSTEM or Administrator by creating specific directories and placing malicious libraries that NetBackup processes (using Strawberry Perl) attempt to load. This allows an attacker to gain full administrative control over the affected system. The vulnerability has a CVSS score of 8.8 (HIGH), indicating a local attack vector with low attack complexity and no user interaction required, leading to high confidentiality, integrity, and availability impacts. It affects NetBackup master, media, and client servers, as well as OpsCenter servers, during installation, upgrades, and normal operations. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.