CVE-2017-12477

What it actually does

Authentication bypass in the bpserverd proprietary protocol allows unauthenticated remote attackers to execute arbitrary commands as root via xinetd.

Why it matters to the business

Full compromise of backup infrastructure enabling data exfiltration, ransomware deployment, or destruction of backups, with high urgency due to weaponized public exploits and elevated EPSS score.

How an attack unfolds

An attacker connects to the bpserverd service exposed through xinetd, crafts a request that bypasses the flawed authentication checks in the proprietary protocol, and then issues commands that execute with root privileges on the target system.

How to fix it

Upgrade Unitrends Backup to version 10.0.0 or later; restrict network access to the bpserverd service until patched.

How to confirm the fix worked

Confirm Unitrends Backup version is 10.0.0 or higher; test that authentication is enforced on the bpserverd protocol and review service exposure via network scans.

Typical attack path

1. Scan for or directly connect to the bpserverd port managed by xinetd
2. Send a crafted authentication bypass payload over the proprietary protocol
3. Execute arbitrary root-level commands to establish persistence or exfiltrate data

How to detect it

Review xinetd and bpserverd logs for unexpected unauthenticated sessions or root command executions; correlate with network connection attempts to the service port.

What your security team should do

• Apply the upgrade to 10.0.0 or later immediately given weaponized exploit maturity
• Segment backup servers and block external access to xinetd-managed ports
• Enable detailed logging on the backup service and monitor for anomalous connections
• Review backup integrity and test restoration procedures