CVE-2021-27876/77/78 — Veritas Backup Exec: Dissecting an Unauthenticated RCE Chain

During a recent engagement I ran into a Veritas Backup Exec Agent sitting on TCP/10000 with no authentication enforced. Three CVEs, one custom exploit script, and a SYSTEM shell — all without touch...