CVE-2017-12478

🗓️ 07 Aug 2017 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 113 Views🌐 WEB

Unitrends Backup (UB) before 10.0.0 has authentication bypass vulnerabilit

Reporter	Title	Published	Views	Family All 20
0day.today	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution Exploit	6 Oct 201700:00	–	zdt
0day.today	Unitrends UEB 9 HTTP API/Storage Remote Root Exploit	22 Oct 201700:00	–	zdt
0day.today	Unitrends UEB HTTP API Remote Code Execution Exploit	6 Oct 201800:00	–	zdt
BDU FSTEC	The vulnerability in the web interface of the API/Storage component of the Unitrends Backup tool allows a perpetrator to bypass authentication procedures or execute arbitrary commands with root privileges.	22 Sep 201700:00	–	bdu_fstec
Circl	CVE-2017-12478	8 Aug 201700:00	–	circl
CNVD	Unitrends Backup Authorization Issues Vulnerability (CNVD-2017-28329)	14 Aug 201700:00	–	cnvd
Check Point Advisories	Kaseya Unitrends Backup Remote Code Execution (CVE-2017-12478)	17 May 202200:00	–	checkpoint_advisories
Cvelist	CVE-2017-12478	7 Aug 201715:00	–	cvelist
Exploit DB	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution	8 Aug 201700:00	–	exploitdb
Exploit DB	Unitrends UEB 9 - http api/storage Remote Root (Metasploit)	23 Oct 201700:00	–	exploitdb

NVD

Node

Source	Link
exploit-db	www.exploit-db.com/exploits/45559/
support	www.support.unitrends.com/UnitrendsBackup/s/article/000005756
exploit-db	www.exploit-db.com/exploits/43030/

Parameter	Position	Path	Description	CWE
hostname	nested	/api/storage	Unauthenticated bypass with potential root RCE via command injection in the hostname field of the api/storage JSON payload.	CWE-287

17 Jun 2026 01:03Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

EPSS0.78269