CVE-2017-12477

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Unitrends UEB 9 - bpserverd Authentication Bypass Remote Command Execution (Metasploit)2017-10-23 · remote · linux_x86 · Verified
• Unitrends UEB 9.1 - 'Unitrends bpserverd' Remote Command Execution2017-08-08 · remote · linux · Verified

Impact

It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://support.unitrends.com/UnitrendsBackup/s/article/000005755
• https://www.exploit-db.com/exploits/43031/
• https://support.unitrends.com/UnitrendsBackup/s/article/000005755
• https://www.exploit-db.com/exploits/43031/