CVE-2014-3139

Unitrends Enterprise Backup 7.3.0 - Unauthenticated Authentication Bypass via SNMPD Auth Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3139. PoCs published by Brandon Perry.

AI-analyzed exploit summary This exploit leverages a hardcoded 'auth' parameter and unsanitized SNMP community string input in Unitrends Enterprise Backup 7.3.0 to achieve unauthenticated remote command execution as root via command injection.

Description

recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.

Exploits (1)

exploitdb WORKING POC
by Brandon Perry · rubyremoteunix
https://www.exploit-db.com/exploits/32885

This exploit leverages a hardcoded 'auth' parameter and unsanitized SNMP community string input in Unitrends Enterprise Backup 7.3.0 to achieve unauthenticated remote command execution as root via command injection.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Unitrends Enterprise Backup 7.3.0
No auth needed
Prerequisites: Network access to the target · SNMP service enabled on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/204
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/32885
Various Sources x_refsource_misc
https://gist.github.com/brandonprry/10745756

Scores

EPSS 0.0331
EPSS Percentile 86.9%

Details

CWE
CWE-287
Status published
Products (1)
unitrends/enterprise_backup 7.3.0
Published May 02, 2014
Tracked Since Feb 18, 2026