Arcserve UDP Unauthenticated RCE
CVE-2023-41998

9.8CRITICAL

Key Information:

Vendor

Arcserve

Status
Arcserve UDP
Vendor
CVE Published:
27 November 2023

What is CVE-2023-41998?

Arcserve UDP prior to version 9.2 includes a flaw in the RPSService4CPMImpl interface that permits an attacker to upload and execute arbitrary files on affected systems. This could lead to unauthorized access or control over the vulnerable system, putting sensitive data at risk.

Affected Version(s)

Arcserve UDP 0 < 9.2

References

https://www.tenable.com/security/research/tra-2023-37

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-41998 : Arcserve UDP Unauthenticated RCE