Vulnerabilities

TI-2015-07635 CVE-2015-9256 · GHSA-c7v9-w3w7-8rcm

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via…

LOW 26

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01035 Published 2018-02-20 No fix listed CWE-200

TI-2015-07634 CVE-2015-9255 · GHSA-p9wj-4c56-234q

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about…

LOW 26

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01035 Published 2018-02-20 No fix listed CWE-200

TI-2015-07633 CVE-2015-9254 · GHSA-x3pw-w85x-hj8p

Datto ALTO and SIRIS devices have a default VNC password.

MEDIUM 44

Datto ALTO and SIRIS devices have a default VNC password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01103 Published 2018-02-20 No fix listed CWE-798

TI-2015-01868 CVE-2015-2081 · GHSA-fg6j-jrpq-q63g

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

MEDIUM 47

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02829 Published 2018-02-20 No fix listed CWE-20

TI-2017-12267 CVE-2017-16674 · GHSA-p7qh-rf7g-6vvf

Datto Windows Agent allows unauthenticated remote command execution via a modified…

LOW 36

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-w…

CVSS 3.0HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00728 Published 2017-11-09 No fix listed

TI-2017-12266 CVE-2017-16673 · GHSA-69r5-6x57-4ffx

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.

LOW 24

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.

CVSS 3.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.0044 Published 2017-11-09 No fix listed CWE-200

Vulnerabilities

Filters

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via…

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about…

Datto ALTO and SIRIS devices have a default VNC password.

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

Datto Windows Agent allows unauthenticated remote command execution via a modified…

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections.