Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Quest Disk Backup could run unauthorized commands

CVE-2018-11178 · published 8 years ago
Summary

Versions of Quest Disk Backup prior to 4.0.3.1 let an attacker insert malicious commands that the program will execute on the server. This could give the attacker control over the backup system and any data it accesses. Update the software to version 4.0.3.1 or later, or apply the vendor’s recommended patch, to stop this risk.

What to do
  • Update quest disk_backup to version 4.0.3.1 or later.
Affected software
VendorProductAffected versions
quest disk_backup < 4.0.3.1
cpe:2.3:a:quest:disk_backup:*:*:*:*:*:*:*:*
Original advisory text
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
4% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published2 Jun 2018
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-11178 · NVD
Track software like this
Free during beta