CVE-2005-0773

EXPLOITED

VERITAS Backup Exec Remote Agent 9.0-10.0 - Remote Code Execution via CONNECT_CLIENT_AUTH Request

Title source: llm

Exploitation Summary

CVE-2005-0773 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Metasploit, hdm, including a Metasploit module exploits/windows/backupexec/remote_agent.

AI-analyzed exploit summary This exploit targets a stack buffer overflow in Veritas Backup Exec Windows Agent (CVE-2005-0773) by sending a malformed authentication request with an overly long password, leading to SEH overwrite and arbitrary code execution.

Description

Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for Netware allows remote attackers to execute arbitrary code via a CONNECT_CLIENT_AUTH request with authentication method type 3 (Windows credentials) and a long password argument.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/16332

View Code ZIP pw:eip

This exploit targets a stack buffer overflow in Veritas Backup Exec Windows Agent (CVE-2005-0773) by sending a malformed authentication request with an overly long password, leading to SEH overwrite and arbitrary code execution.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Veritas Backup Exec Windows Agent 9.0/9.1/10.0

No auth needed

Prerequisites: Network access to the target's NDMP service (port 10000)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC GREAT

by hdm · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/backupexec/remote_agent.rb