What is CVE-2017-16673?

CVE-2017-16673 is a medium-severity vulnerability in Datto Backup Agent, classified under Information Disclosure. CVSS score: 5.3/10. Published 2017-11-09.

How severe is CVE-2017-16673?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Datto Backup Agent

CVE-2017-16673

Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified "specific information" by which the agent identifies a network device that is "appearing to be a valid Datto."

Vulnerability class: Information Disclosure

EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Datto Backup_agent
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2017-16673?: CVE-2017-16673 is a medium-severity vulnerability in Datto Backup Agent, classified under Information Disclosure. CVSS score: 5.3/10. Published 2017-11-09.
How severe is CVE-2017-16673?: Medium severity. CVSS v3 base score is 5.3 out of 10.