{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI Cyber Backup v2.3.0 (AOMEI). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nAOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four Thrift binary-protocol ports, but only \nthe 9072 Gateway enforces JWT authentication. The three internal Thrift ports (9074, 9077, 9078) bind to the container \nnetwork with no authentication handler. An attacker who can reach ports 9074 and 9078 persists an injected NAS \ncredential via AddBackupStorageNAS, then triggers DeleteBackupStorage, whose async lambda builds a CIFS mount command \nvia system() with unescaped username and password fields. A single-quote escape in the username field injects an \narbitrary shell command that executes as root (uid=0). The chain requires only network reachability to the internal \nThrift ports; no credentials and no user interaction are required.\n\nImpact: Arbitrary command execution as root (uid=0) inside the backup infrastructure container; the attacker can read \nbackup metadata and stored credentials, alter backup storage records, and disrupt or destroy backup operations.\n\nAdvisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/3"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0051",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3",
            "automated": true,
            "contentSha256": "2d677b0e8b05bc9a486a16164155baf0f0f0c8dc765a31eb2c875bb214157a44",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0051"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}