CVE-2017-12478 It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw t...
CriticalCVSS 9.8
EPSS 78.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kaseya unitrends backup | < 10.0 | 10.0 |
References
- support.unitrends.com vendor-advisory
- 43030 exploit third-party-advisory vdb-entry
- 45559 exploit third-party-advisory vdb-entry