CVE-2017-12478

🗓️ 07 Aug 2017 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 139 Views🌐 WEB

Unitrends Backup (UB) before 10.0.0 has authentication bypass vulnerabilit

Reporter	Title	Published	Views	Family All 22
zdt	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution Exploit	6 Oct 201700:00	–	zdt
zdt	Unitrends UEB 9 HTTP API/Storage Remote Root Exploit	22 Oct 201700:00	–	zdt
zdt	Unitrends UEB HTTP API Remote Code Execution Exploit	6 Oct 201800:00	–	zdt
BDU FSTEC	The vulnerability in the web interface of the API/Storage component of the Unitrends Backup tool allows a perpetrator to bypass authentication procedures or execute arbitrary commands with root privileges.	22 Sep 201700:00	–	bdu_fstec
Circl	CVE-2017-12478	8 Aug 201700:00	–	circl
CNVD	Unitrends Backup Authorization Issues Vulnerability (CNVD-2017-28329)	14 Aug 201700:00	–	cnvd
Check Point Advisories	Kaseya Unitrends Backup Remote Code Execution (CVE-2017-12478)	17 May 202200:00	–	checkpoint_advisories
Cvelist	CVE-2017-12478	7 Aug 201715:00	–	cvelist
Exploit DB	Unitrends UEB 9.1 - Authentication Bypass / Remote Command Execution	8 Aug 201700:00	–	exploitdb
Exploit DB	Unitrends UEB 9 - http api/storage Remote Root (Metasploit)	23 Oct 201700:00	–	exploitdb

NVD

Node

Source	Link
exploit-db	www.exploit-db.com/exploits/45559/
support	www.support.unitrends.com/UnitrendsBackup/s/article/000005756
exploit-db	www.exploit-db.com/exploits/43030/

Parameter	Position	Path	Description	CWE
AuthToken	header	/api/storage	SQL injection in AuthToken header enabling authentication bypass and remote root code execution via crafted request.	CWE-287
hostname	nested	/api/storage	Command injection in JSON payload via hostname field to execute arbitrary commands as root.	CWE-287
ip	nested	/api/hosts	Command injection in hosts endpoint payload enabling RCE on vulnerable UEB versions.	CWE-287

17 Jun 2026 01:03Current

8.3High risk

Vulners AI Score8.3

CVSS 3.19.8

CVSS 210

EPSS0.78269