{"uuid": "dc5863cf-59b4-4df3-a205-439a7b27d584", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-0647", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/emc/replication_manager_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Unknown\", \"Davy Douhine\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a remote command-injection vulnerability in EMC Replication Manager\\n          client (irccd.exe). By sending a specially crafted message invoking RunProgram function an\\n          attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected\\n          products are EMC Replication Manager < 5.3. This module has been successfully tested\\n          against EMC Replication Manager 5.2.1 on XP/W2003. EMC Networker Module for Microsoft\\n          Applications 2.1 and 2.2 may be vulnerable too although this module have not been tested\\n          against these products.\", \"disclosure_date\": \"2011-02-07\", \"fullname\": \"exploit/windows/emc/replication_manager_exec\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"EMC Replication Manager Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/emc/replication_manager_exec.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"windows/emc/replication_manager_exec\", \"references\": [\"CVE-2011-0647\", \"OSVDB-70853\", \"BID-46235\", \"URL-http://www.securityfocus.com/archive/1/516260\", \"ZDI-11-061\"], \"rport\": 6542, \"session_types\": false, \"targets\": [\"EMC Replication Manager 5.2.1 / Windows Native Payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:18.615322Z"}