Description
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Commvault | Service Pack 6 | Version 11 prior to SP7, version 11 SP6 prior to hotfix 590 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC) EDB-41823 · dos · Mar 16, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://kb.commvault.com/article/SEC0013
- http://redr2e.com/commvault-edge-cve-2017-3195/
- 41823 exploit
- VU#214283 third-party-advisory
- 96941 vdb-entry