CVE-2017-12478

# Exploit Title: Unauthenticated root RCE for Unitrends UEB 91 # Date: 08/08/2017 # Exploit Authors: Cale Smith, Benny Husted, Jared Arave # Contact: twittercom/iotennui || twittercom/BennyHusted || twittercom/0xC413 # Vendor Homepage: wwwunitrendscom/ # Software Link: wwwunitrendscom/download/enterpr ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, ...

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 1000 has an issue in which one of its input parameters was not validated A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system ...

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 1000 has an issue in which one of its input parameters was not validated A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system UEB v9 runs the api under root privileges and api/sto ...

Unitrends UEB version 91 suffers from authentication bypass and remote command execution vulnerabilities ...