CVE-2018-6328

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

• CWE-287

• https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
• https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry
• https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
• https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry

Published

Mar 14, 2018

Last Modified

Jun 17, 2026

Status

Modified