CVE-2024-3781: Critical Command Injection in WBSAirback

CVE-2024-3781 is a critical severity vulnerability (CVSS 9.1) in WBSAirback. Improper neutralization in the Active Directory integration lets the intended command be modified when sent to a downstream component. The record cites an INCIBE-CERT advisory on multiple vulnerabilities in WBSAirback.

What's affected

• White Bear Solutions WBSAirback version 21.02.04, according to the record.

Severity in the record: Critical, CVSS 9.1, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. In plain terms: over the network, high privileges required, no user interaction. Weakness class: CWE-78, OS command injection.

Fixed version: The record cites an INCIBE-CERT advisory on multiple vulnerabilities in WBSAirback. Check it for the fixed release.

The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.

How to check if you're exposed

1. Check the version in the WBSAirback administration interface and compare it with 21.02.04.
2. Confirm whether the management interface is reachable from outside your network.

What to do now

1. Install the vendor fix as soon as it is published.
2. Restrict the management interface to a trusted network and require authentication in front of it.
3. Run the service as an unprivileged user so a command that does run has limited reach.
4. Watch process and audit logs on the host for commands the application does not normally start.
5. Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3781.

Why it matters

Command injection occurs when an application passes user influenced text to a shell or to an external program without neutralizing special characters. The operating system then runs more than the developer intended. Safer designs avoid the shell, call programs with a fixed argument list, and validate every value against a strict allow list.

WBSAirback is a backup product, and backup systems hold copies of everything. A command injection on the appliance operating system is a significant risk because the box often has wide access to the data it protects. The injectable component is the Active Directory integration, so anyone who can reach that function matters.

Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.

Quick check

Sources

These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.

• www.incibe.es

Last reviewed: 19 October 2026.