Unitrends < 10.0.0 Multiple Vulnerabilities

Unitrends UEB is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Unitrends UEB 9 - bpserverd Authentication Bypass Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitrends UEB bpserverd authentication bypass RCE', 'Description' = %q It was discovered that the Unitrends bpserverd proprietary protocol, as...

Unitrends UEB bpserverd Authentication Bypass / Remote Command Execution Exploit

It was discovered that the api/storage web interface in Unitrends Backup UB before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. Th...

Unitrends UEB bpserverd Authentication Bypass / Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitrends UEB bpserverd authentication bypass RCE', 'Description' = %q It was discovered that the Unitrends bpserverd proprietary protocol, as...

Unitrends UEB bpserverd authentication bypass RCE

It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system. This module requires Metasploit:...

Unitrends UEB 9.1 bpserverd Remote Command Execution

Exploit Title: Unauthenticated root RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Jared Arave, Cale Smith, Benny Husted Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

CVE-2017-12477

creationtimestamp| type| source ---|---|--- 2017-08-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42957 2017-10-23 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43031 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-12477

It was discovered that the bpserverd proprietary protocol in Unitrends Backup UB before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system...

CVE-2017-12477

Unitrends UEB bpserverd in UB versions prior to 10.0.0 is vulnerable to an authentication bypass via the bpserverd protocol exposed through xinetd, enabling remote root command execution. Public references (exploit-db, metasploit, OpenVAS entries) document the RCE actions. Affected: Unitrends Bac...