PT-2025-34948 · Arcserve · Arcserve Unified Data Protection

Watchtowr

·

Published

2025-08-27

·

Updated

2026-05-26

·

CVE-2025-34522

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Arcserve Unified Data Protection (UDP) versions 7.x and earlier Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1 Arcserve Unified Data Protection (UDP) versions prior to 10.2
Description: A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows an attacker to overwrite heap memory, potentially leading to application crashes or remote code execution. Exploitation occurs in the context of the affected process and does not require user interaction. The vulnerability poses a high risk due to its pre-authentication nature and potential for full compromise.
Recommendations: Arcserve Unified Data Protection (UDP) versions 7.x and earlier: Upgrade to version 10.2 to remediate the issue. Arcserve Unified Data Protection (UDP) versions 8.0 through 10.1: Apply the necessary patch or upgrade to version 10.2. Arcserve Unified Data Protection (UDP) versions prior to 10.2: Upgrade to version 10.2.

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2025-34522

Affected Products

Arcserve Unified Data Protection