by Kastro
Paper/Archive/CVE-2021-43033

CVE-2021-43033

mitre — An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.5.935 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhelpdesk.kaseya.com/hc/en-gb/articles/4412762258961refcyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1refcyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2