CRITICAL: CVE-2014-3008 (CVSS 10) — unitrends enterprise backup

CVE: CVE-2014-3008

CVSS: 10 (2.0) — AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: CRITICAL

Status: Critical advisory

Affected

• unitrends enterprise backup

Summary

Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.

Verified Sources

• NVD entry
• GitHub Advisory
• MITRE

References

• http://seclists.org/fulldisclosure/2014/Apr/204
• http://secunia.com/advisories/58001
• http://www.exploit-db.com/exploits/32885
• http://www.securityfocus.com/bid/66928
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92642
• https://gist.github.com/brandonprry/10745756
• http://seclists.org/fulldisclosure/2014/Apr/204
• http://secunia.com/advisories/58001
• http://www.exploit-db.com/exploits/32885
• http://www.securityfocus.com/bid/66928

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._