Ahsaycbs
Monthly
Unauthenticated OS command injection in Ahsay AhsayCBS (versions 10.3.0 through 10.3.2) allows a remote attacker to execute arbitrary operating system commands on the backup server by supplying crafted shell metacharacters in the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are required, and both the CVSS v4.0 score of 9.3 and the independently assessed CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicate full confidentiality, integrity, and availability impact on the host. Publicly available exploit code exists (E:P) and the flaw is described as published and usable, though there is no CISA KEV confirmation of active exploitation at time of analysis; reporting originates from a single source (VulDB), so corroboration is limited. A vendor patch is available: upgrading to AhsayCBS 10.3.4 resolves the issue.
Improper authentication in AhsayCBS up to version 10.3.2 lets an unauthenticated remote attacker bypass credential verification by manipulating the 'random' parameter processed by the checkSysPwd routine in the API component (com/ahsay/obs/api/ApiStructsAction.java). Exploitation requires only network reachability to the exposed AhsayCBS API/management interface and publicly available exploit code exists, so deployments that leave the console internet-facing or broadly reachable are the most at risk. The assessed impact is limited to partial confidentiality, integrity, and availability effects, and no confirmed active exploitation (CISA KEV) has been reported, making this a moderate-priority issue that is nonetheless straightforward to trigger where the API is exposed.
Unauthenticated OS command injection in Ahsay AhsayCBS (versions 10.3.0 through 10.3.2) allows a remote attacker to execute arbitrary operating system commands on the backup server by supplying crafted shell metacharacters in the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The CVSS vector confirms no privileges (PR:N) and no user interaction (UI:N) are required, and both the CVSS v4.0 score of 9.3 and the independently assessed CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicate full confidentiality, integrity, and availability impact on the host. Publicly available exploit code exists (E:P) and the flaw is described as published and usable, though there is no CISA KEV confirmation of active exploitation at time of analysis; reporting originates from a single source (VulDB), so corroboration is limited. A vendor patch is available: upgrading to AhsayCBS 10.3.4 resolves the issue.
Improper authentication in AhsayCBS up to version 10.3.2 lets an unauthenticated remote attacker bypass credential verification by manipulating the 'random' parameter processed by the checkSysPwd routine in the API component (com/ahsay/obs/api/ApiStructsAction.java). Exploitation requires only network reachability to the exposed AhsayCBS API/management interface and publicly available exploit code exists, so deployments that leave the console internet-facing or broadly reachable are the most at risk. The assessed impact is limited to partial confidentiality, integrity, and availability effects, and no confirmed active exploitation (CISA KEV) has been reported, making this a moderate-priority issue that is nonetheless straightforward to trigger where the API is exposed.