PT-2025-34947 · Arcserve · Arcserve Unified Data Protection

Watchtowr · Published 2025-08-27 · Updated 2025-08-28 · CVE-2025-34521

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Arcserve Unified Data Protection (UDP) versions prior to 10.2 Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1 Arcserve Unified Data Protection (UDP) versions 7.x and earlier

Description: A reflected cross-site scripting (XSS) vulnerability exists in the web interface of Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by another user, execute arbitrary JavaScript in the victim’s browser. Successful exploitation may lead to session hijacking, credential theft, or other client-side impacts. The vulnerability requires user interaction and occurs within a shared browser context.

Recommendations: Arcserve Unified Data Protection (UDP) versions prior to 10.2: Upgrade to version 10.2 to remediate the issue. Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1: Apply the necessary patch or upgrade to version 10.2. Arcserve Unified Data Protection (UDP) versions 7.x and earlier: Upgrade to version 10.2 to remediate the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34521

Affected Products

Arcserve Unified Data Protection

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-34521 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34521 · Vendor Advisory
• https://t.me/CVEtracker/31086 · Telegram Post
• https://twitter.com/CVEnew/status/1960822223180083238 · Twitter Post
• https://support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Arcserve-UDP-customers-on-all-versions · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1960893452440260724 · Twitter Post