Default credentials

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default...

CVE-2015-9255

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory...

CVE-2015-9254

CVE-2015-9254 affects Datto ALTO and SIRIS devices, where a default VNC password enables unauthenticated access to the devices. The root cause is the use of a default credential for VNC, allowing potential remote control or exposure of sensitive information via the VNC interface. Public reference...

CVE-2015-2081

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts...

CVE-2015-9255

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory...

CVE-2015-9254

Datto ALTO and SIRIS devices have a default VNC password...

CVE-2015-2081

Datto ALTO and SIRIS devices are affected by CVE-2015-2081, allowing Remote Code Execution via unauthenticated requests to PHP scripts. This vulnerability is documented in the NVD entry for CVE-2015-2081, which lists Datto ALTO and SIRIS as the affected products and describes the attack as unauth...

CVE-2015-9256

CVE-2015-9256 affects Datto ALTO and SIRIS devices. The flaw arises because restore mount points (device/VM) are accessible without ACLs by default, enabling remote attackers to obtain sensitive information from these mounts. The connected records corroborate the issue’s existence and affected co...

CVE-2015-9256

Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default...

CVE-2015-9255

Datto ALTO and SIRIS devices are affected by CVE-2015-9255 through a web app Web Virtual Directory exposure that allows remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines. The root cause is information disclosure via an accessible W...

Datto Windows Agent Command Execution Vulnerability

Datto Windows Agent DWA is a suite of Windows-based backup agent software from Datto, Inc. A command execution vulnerability exists in DWA version 1.0.5.0 and earlier. A remote attacker can exploit this vulnerability to execute commands with the help of malformed commands...

Datto Backup Agent Forgery Vulnerability

Datto Backup Agent is a set of data backup agent software from Datto Inc. in the United States. A forgery vulnerability exists in Datto Backup Agent version 1.0.6.0 and earlier. An attacker can exploit this vulnerability to spoof the Datto Backup Appliance and send requests to the agent...

Datto Windows Agent Remote Code Execution Vulnerability

Datto Windows Agent suffers from multiple remote code execution vulnerabilities. Credits ======= Brian Vincent, Michael Brumlow Software ======== Datto Windows Agent Vulnerability Details ===================== Discovered: Aug 25, 2017 Type: Remote code execution as LocalSystem Severity: Critical...

CVE-2017-16674

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent DWA 1.0.5.0 and earlier...

Information disclosure

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified...

CVE-2017-16674

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent DWA 1.0.5.0 and earlier...

CVE-2017-16673

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified...

CVE-2017-16674

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent DWA 1.0.5.0 and earlier...

Command injection

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent DWA 1.0.5.0 and earlier...

CVE-2017-16673

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified...