CVE-2017-18044 Command injection in n/a

What is CVE-2017-18044?

CVE-2017-18044 is a critical command injection vulnerability in n/a, published on 19 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.

Weakness: CWE-78

Which versions are affected by CVE-2017-18044?

It affects 1 product.

Products include Commvault Commvault.

How do I fix CVE-2017-18044?

No fix has been published for CVE-2017-18044 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-18044 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-18044 exists.

Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2025-34028 Commvault Command Center Path Traversal Exploited Critical 9.3
• CVE-2025-3928 Commvault Web Server Unspecified Exploited High 8.7
• CVE-2026-77089 Command Center API Authentication Bypass Critical 9.3
• CVE-2026-13737 Command Restriction Bypass Critical 9.2
• CVE-2026-13738 Improper Authorization Validation Critical 9.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr74-c8hv-6762.