What’s Vulnerable › Vulnerabilities

CVE-2017-7283

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-20 · updated 2026-06-17
• Weakness: CWE-20

Description

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

Affected products

• Unitrends Enterprise Backup: through 9.1.1

References

• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/
• https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1
• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/
• https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1

Get alerted when CVE-2017-7283 or the next vulnerability affects your stack