CVE-2017-12478

CRITICAL 9.8CVE-2017-12478 · Published 07/08/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
unitrends backup kaseya	`< 10.0`	`10.0`

Description

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.

References

support.unitrends.com/UnitrendsBackup/s/article/000005756 · Vendor Advisory
exploit-db.com/exploits/43030 · Exploit
exploit-db.com/exploits/45559 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free