Reflected XSS Vulnerability in Arcserve Unified Data Protection Product

CVE-2025-34521

What is CVE-2025-34521?

A reflected cross-site scripting (XSS) vulnerability exists in the web interface of Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows a remote attacker with low privileges to craft malicious links that, if clicked by another user, can execute arbitrary JavaScript in the victim's browser. This exploitation can lead to session hijacking, credential theft, or other malicious impacts on client-side interactions. User interaction is mandatory for successful exploitation, and it occurs within a shared browser context. To mitigate this issue, users with versions 8.0 through 10.1 should apply patches or upgrade to version 10.2, which includes necessary security enhancements. Versions 7.x and earlier are unsupported and must be upgraded to 10.2 to resolve the vulnerability.

References