PT-2017-14517 · Datto · Datto Windows Agent

Published 2017-11-09 · Updated 2019-10-03 · CVE-2017-16674

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Datto Windows Agent versions 1.0.5.0 and earlier

Description The issue allows unauthenticated remote command execution via a modified command. This can be achieved by combining a malformed primary whitelisted command with a secondary non-whitelisted command. An attacker could exploit this issue to gain unauthenticated access to all agent machines running the affected Datto Windows Agent versions.

Recommendations For Datto Windows Agent versions 1.0.5.0 and earlier, update to a version later than 1.0.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the Datto Windows Agent to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2017-16674

Affected Products

Datto Windows Agent

References · 3

• https://datto.com/partner-security-update-nov2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16674 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16674 · Vendor Advisory