Datto

datto

6 CVEs • 18 products

Products (18)

Click to collapse

Toggle

Alto 3 Firmware

alto_3_firmware

Alto 2 Firmware

alto_2_firmware

Alto Xl Firmware

alto_xl_firmware

Siris 3 Firmware

siris_3_firmware

Siris 2 Firmware

siris_2_firmware

Siris 3 X All Flash Firmware

siris_3_x_all-flash_firmware

Siris Virtual Firmware

siris_virtual_firmware

Alto Imaged Firmware

alto_imaged_firmware

Siris 3 X All Flash

siris_3_x_all-flash

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-9256 1Datto 8Alto 2 Firmware Alto 3 FirmwareAlto Imaged Firmware+5 more Nov 21, 2024 Feb 20, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
CVE-2015-9255 1Datto 8Alto 2 Firmware Alto 3 FirmwareAlto Imaged Firmware+5 more Nov 21, 2024 Feb 20, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
CVE-2015-9254 1Datto 8Alto 2 Firmware Alto 3 FirmwareAlto Imaged Firmware+5 more Nov 21, 2024 Feb 20, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Datto ALTO and SIRIS devices have a default VNC password.
CVE-2015-2081 1Datto 8Alto 2 Firmware Alto 3 FirmwareAlto Imaged Firmware+5 more Nov 21, 2024 Feb 20, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
CVE-2017-16674 1Datto 1Windows Agent May 13, 2026 Nov 9, 2017 N/A· v4 8.0 HIGH· v3 4.9 MEDIUM· v2 Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-w...Show more Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.Show less
CVE-2017-16673 1Datto 1Backup Agent May 13, 2026 Nov 9, 2017 N/A· v4 5.3 MEDIUM· v3 2.9 LOW· v2 Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacke...Show more Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified "specific information" by which the agent identifies a network device that is "appearing to be a valid Datto."Show less