PT-2025-34946 · Arcserve · Arcserve Unified Data Protection

Watchtowr · Publicado 2025-08-27 · Atualizado 2026-03-01 · CVE-2025-34520

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Arcserve Unified Data Protection (UDP) versions prior to 10.2 Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1 Arcserve Unified Data Protection (UDP) versions 7.x and earlier

Description: An authentication bypass in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. Attackers can bypass login mechanisms without valid credentials and access administrator-level features by manipulating request parameters or exploiting a logic flaw.

Recommendations: Upgrade to Arcserve Unified Data Protection (UDP) version 10.2. Apply the available patch for Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1. Upgrade to Arcserve Unified Data Protection (UDP) version 10.2 from versions 7.x and earlier.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-34520

Produtos afetados

Arcserve Unified Data Protection

Referências · 7

• https://t.me/cveNotify/134779 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-34520 · Nota de Segurança
• https://t.me/CVEtracker/31085 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-34520 · Aviso do Fabricante
• https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions · Correção, Aviso do Fabricante
• https://twitter.com/CVEnew/status/1960822222248882423 · Publicação no Twitter
• https://twitter.com/stratosberry/status/2028113210054779083 · Publicação no Twitter