CVE-2006-4902: Symantec Veritas Netbackup Client

High severity, CVSS 10.0. EPSS: 4.3% chance of exploitation in the next 30 days.

The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 does not properly check for chained commands, which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.

Affected products

• Symantec Veritas Netbackup Client: version 5.0 only; version 5.1 only; version 6.0 only
• Symantec Veritas Netbackup Enterprise Server: version 5.0 only; version 5.1 only; version 6.0 only
• Symantec Veritas Netbackup Server: version 5.0 only; version 5.1 only; version 6.0 only

Published 2006-12-14. Last modified 2026-06-16.