CVE-2017-16673 - CVE House
Back to Database
Status published Medium CVE-2017-16673

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming...

Vulnerability Description

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified "specific information" by which the agent identifies a network device that is "appearing to be a valid Datto."

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16673

Credits & Attribution

No credits recorded in the NVD database.

References

More from datto

View All →
CVE-2017-16674
Datto Windows Agent allows unauthenticated remote command execution via a...
High 8
CVE-2015-9256
Datto ALTO and SIRIS devices allow remote attackers to obtain...
Medium 5.3
CVE-2015-9255
Datto ALTO and SIRIS devices allow remote attackers to obtain...
Medium 5.3
CVE-2015-9254
Datto ALTO and SIRIS devices have a default VNC password....
Critical 9.8
CVE-2015-2081
Datto ALTO and SIRIS devices allow Remote Code Execution via...
Critical 9.8

Affected Vendor

Affected Software

backup agent
Vulnerable Versions:
0

Timeline

Official Publish: November 9th, 2017
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.