CVE-2017-16674 - CVE House
Back to Database
Status published High CVE-2017-16674

Datto Windows Agent allows unauthenticated remote command execution via a...

Vulnerability Description

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16674

Credits & Attribution

No credits recorded in the NVD database.

References

More from datto

View All →
CVE-2017-16673
Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming...
Medium 5.3
CVE-2015-9256
Datto ALTO and SIRIS devices allow remote attackers to obtain...
Medium 5.3
CVE-2015-9255
Datto ALTO and SIRIS devices allow remote attackers to obtain...
Medium 5.3
CVE-2015-9254
Datto ALTO and SIRIS devices have a default VNC password....
Critical 9.8
CVE-2015-2081
Datto ALTO and SIRIS devices allow Remote Code Execution via...
Critical 9.8

Affected Vendor

Affected Software

windows agent
Vulnerable Versions:
0

Timeline

Official Publish: November 9th, 2017
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.