CVE-2017-18044: A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the…

PriorityP277critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

69.75%

99.3th percentile

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
commvault	commvault	<= 11.0	—
commvault	commvault	—	—

Detection & IOCsextracted from sources · hover to see the quote

pathContentStore/Base/CVDataPipe.dll↗

processcvd.exe↗

→Monitor the cvd daemon / cvd.exe service for anomalous child process creation via CreateProcess, which may indicate command injection exploitation. ↗
→Alert on unauthenticated inbound network messages to the Commvault Communications Service (cvd) that result in process spawning, as exploitation requires no authentication. ↗
→Inspect CVDataPipe.dll message parsing routines for specially crafted strings containing command injection payloads targeting the CreateProcess call. ↗

·The Commvault Communications service runs as SYSTEM by default on Windows with no authentication required, meaning any network-reachable host running cvd is exposed without credential barriers. ↗
·This is a distinct vulnerability from CVE-2017-3195, which also affects Commvault; ensure detections and patches address both CVEs separately. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.