PT-2017-14517 · Datto · Datto Windows Agent

Publicado 2017-11-09 · Atualizado 2019-10-03 · CVE-2017-16674

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Datto Windows Agent versions 1.0.5.0 and earlier

Description The issue allows unauthenticated remote command execution via a modified command. This can be achieved by combining a malformed primary whitelisted command with a secondary non-whitelisted command. An attacker could exploit this issue to gain unauthenticated access to all agent machines running the affected Datto Windows Agent versions.

Recommendations For Datto Windows Agent versions 1.0.5.0 and earlier, update to a version later than 1.0.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the Datto Windows Agent to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2017-16674

Produtos afetados

Datto Windows Agent

Referências · 3

• https://datto.com/partner-security-update-nov2017 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16674 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16674 · Aviso do Fabricante