CRITICAL🇵🇱 Wersja polska

CVE-2021-43033

CVSS 9.8v3.1pub. 2021-12-06upd. 2024-11-21

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Kaseya Unitrends Backup

    APP
    Kaseya
    10.0 – 10.5.5 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2021-40386CRITICAL9.8PL ✓same product

RCE w Kaseya Unitrends Client/Agent — zdalne wykonanie kodu

CVE-2021-43036CRITICAL9.8PL ✓same product

Słabe hasło konta PostgreSQL wguest w Kaseya Unitrends Backup

CVE-2021-43035CRITICAL9.8PL ✓same product

SQL Injection i RCE w Kaseya Unitrends Backup Appliance

CVE-2021-43042CRITICAL9.8PL ✓same product

Buffer overflow w Kaseya Unitrends Backup — zdalne wykonanie kodu bez uwierzytelnienia

CVE-2021-43044CRITICAL9.8PL ✓same product

Kaseya Unitrends Backup: słabe domyślne hasło SNMP (CWE-798)