CVE-2017-12477

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

68.22%

Published

Aug 7, 2017

Modified

May 12, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBUnitrends UEB 9.1 - 'Unitrends bpserverd' Remote Command Execution Exploit-DBUnitrends UEB 9 - bpserverd Authentication Bypass Remote Command Execution (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

Affected Products (1)

kaseya · unitrends_backup (up to 10.0)vulnerable

References (4)

https://support.unitrends.com/UnitrendsBackup/s/article/000005755

Vendor Advisory

https://www.exploit-db.com/exploits/43031/

ExploitThird Party AdvisoryVDB Entry

https://support.unitrends.com/UnitrendsBackup/s/article/000005755

Vendor Advisory

https://www.exploit-db.com/exploits/43031/

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs