CVE-2017-12478 : Security Advisory and Response

Unitrends Backup (UB) version before 10.0.0 is vulnerable to a remote code execution exploit through the api/storage web interface.

Understanding CVE-2017-12478

This CVE identifies a critical vulnerability in Unitrends Backup (UB) that allows remote attackers to execute arbitrary commands with root privilege.

What is CVE-2017-12478?

The vulnerability in Unitrends Backup (UB) version before 10.0.0 allows remote attackers to bypass authentication and gain unauthorized access to execute arbitrary commands with root privilege.

The Impact of CVE-2017-12478

The exploitation of this vulnerability can lead to unauthorized access and potential compromise of the targeted system, posing a significant security risk.

Technical Details of CVE-2017-12478

Unitrends Backup (UB) version before 10.0.0 is susceptible to a critical security flaw.

Vulnerability Description

The vulnerability arises from the lack of validation of input parameters in the api/storage web interface, enabling remote attackers to execute arbitrary commands with root privilege.

Affected Systems and Versions

Product: Unitrends Backup (UB)
Versions affected: Before 10.0.0

Exploitation Mechanism

Attackers exploit the lack of input parameter validation to bypass authentication and gain unauthorized access.

Mitigation and Prevention

Immediate action is crucial to mitigate the risks associated with CVE-2017-12478.

Immediate Steps to Take

Update Unitrends Backup (UB) to version 10.0.0 or later to patch the vulnerability.
Implement network segmentation to restrict access to critical systems.
Monitor and analyze network traffic for any suspicious activities.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Conduct security assessments and penetration testing to identify and remediate weaknesses.
Educate users on cybersecurity best practices to prevent social engineering attacks.

Patching and Updates

Unitrends has released version 10.0.0 to address the vulnerability. Ensure timely installation of patches and updates to enhance system security.