Vulnerability record · CVE-2018-6329 · published 14 March 2018
CVE-2018-6329: Unitrends Backup libbpext.so authentication bypass via SQL injection
Unitrends · Backup
Unitrends Backup before 10.1.0 contains a SQL injection in the libbpext.so authentication path that lets an attacker bypass authentication. Because the flaw is reachable over the network without credentials, it exposes the backup server to full compromise.
Description
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network-reachable, unauthenticated authentication bypass and public exploit code makes this a critical risk for exposed Unitrends Backup servers.
What it is
Unitrends Backup before 10.1.0 contains a SQL injection in the libbpext.so authentication path that lets an attacker bypass authentication. Because the flaw is reachable over the network without credentials, it exposes the backup server to full compromise.
Impact
An unauthenticated remote attacker can bypass authentication, place a privilege escalation exploit on the target, and execute arbitrary commands, gaining control of the backup server.
Attack surface
Reachable over the network via the affected authentication component (CVSS vector AV:N/PR:N/UI:N), so no authentication or user interaction is required. The description does not specify the exact port or endpoint.
Exploitation
Public exploit code exists in Exploit-DB (references tagged Exploit), and EPSS is 0.61239 (99.1st percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.
What to do
- Upgrade Unitrends Backup to version 10.1.0 or later as the primary fix.
- If immediate patching is not possible, restrict network access to the backup server's management and authentication interfaces to trusted hosts only.
- Monitor and review the vendor advisories (support.unitrends.com articles 000001150 and 000006003) for any interim guidance.
- Audit the backup server for unexpected files, processes, or scheduled tasks that could indicate a placed privilege escalation exploit.
Detection
- Inspect web/application logs for SQL injection patterns (e.g., UNION, OR 1=1, stacked queries) targeting the authentication endpoint.
- Alert on authentication attempts that succeed without a valid prior login sequence or from unexpected source IPs.
- Monitor for new or modified executable files and suspicious child processes spawned by the Unitrends Backup service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.unitrends.com/UnitrendsBackup/s/article/000001150 | Vendor Advisory |
| https://support.unitrends.com/UnitrendsBackup/s/article/000006003 | Vendor Advisory |
| https://www.exploit-db.com/exploits/44297/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/45913/ | ExploitThird Party AdvisoryVDB Entry |
| https://support.unitrends.com/UnitrendsBackup/s/article/000001150 | Vendor Advisory |
| https://support.unitrends.com/UnitrendsBackup/s/article/000006003 | Vendor Advisory |
| https://www.exploit-db.com/exploits/44297/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/45913/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-6329 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-6329), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
