CVE-2013-4678: The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 all...

Security readout for executives and security teams

This CVE describes an information disclosure issue in Symantec Backup Exec’s NDMP protocol handling. An authenticated remote user could obtain sensitive host-version information from affected Backup Exec 2010 R3 and 2012 installations. The available sources do not describe broader compromise, unauthenticated access, or active exploitation. Exposure is most likely where legacy Symantec Backup Exec 2010 R3 or 2012 remains deployed and NDMP is reachable by authenticated users. Internet exposure is not stated in the sources and should not be assumed. Treat this as a legacy backup-platform hygiene issue, not an emergency based on current evidence. Prioritize remediation if affected Backup Exec systems protect critical data or are reachable by many users. Mitigation focus: Identify any Backup Exec 2010 R3 or 2012 deployments.; Apply Symantec Backup Exec 2010 R3 SP3 or 2012 SP2 as applicable.; Restrict NDMP access to trusted administrative networks and accounts..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.