AOMEI Cyber Backup: Unauthenticated Root RCE via Thrift NAS Mount Injection

AOMEI Cyber Backup v2.3.0 exposes three internal Thrift ports (9074/9077/9078) with no auth handler, bypassing the 9072 Gateway JWT. An attacker who reaches 9074 and 9078 injects a NAS credential, then triggers a CIFS mount via system() with unescaped fields — a single-quote escape yields unauthenticated root RCE (uid=0).