Datto

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Datto records in CISA KEV

No Datto vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Alto 2 Firmware 4 records MEDIUM Alto 3 Firmware 4 records MEDIUM Alto Imaged Firmware 4 records MEDIUM Alto Xl Firmware 4 records MEDIUM Siris 2 Firmware 4 records MEDIUM Siris 3 Firmware 4 records MEDIUM Siris 3 X All-flash Firmware 4 records MEDIUM Siris Virtual Firmware 4 records MEDIUM

Records

6 records

TI-2015-01868 CVE-2015-2081 · GHSA-fg6j-jrpq-q63g

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

MEDIUM 47

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02829 Published 2018-02-20 No fix listed CWE-20

TI-2015-07633 CVE-2015-9254 · GHSA-x3pw-w85x-hj8p

Datto ALTO and SIRIS devices have a default VNC password.

MEDIUM 44

Datto ALTO and SIRIS devices have a default VNC password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01103 Published 2018-02-20 No fix listed CWE-798

TI-2017-12267 CVE-2017-16674 · GHSA-p7qh-rf7g-6vvf

Datto Windows Agent allows unauthenticated remote command execution via a modified…

LOW 36

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-w…

CVSS 3.0HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00728 Published 2017-11-09 No fix listed

TI-2015-07635 CVE-2015-9256 · GHSA-c7v9-w3w7-8rcm

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via…

LOW 26

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01035 Published 2018-02-20 No fix listed CWE-200

TI-2015-07634 CVE-2015-9255 · GHSA-p9wj-4c56-234q

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about…

LOW 26

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01035 Published 2018-02-20 No fix listed CWE-200

TI-2017-12266 CVE-2017-16673 · GHSA-69r5-6x57-4ffx

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.

LOW 24

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.

CVSS 3.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.0044 Published 2017-11-09 No fix listed CWE-200

Open these records in search →

Critical	2
High	1
Medium	3
Low	0
No CVSS	0