XSS in Arcserve Udp
CVE-2025-34521
A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by another user, execute arbitrary JavaScript in the victim’s browser. Successful exploitation may lead to session hijacking, credential theft, or other client-side impacts. The vulnerability requires user interaction and occurs within a shared browser context. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 10.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Arcserve Udp — versions 7.0
- Arcserve Unified Data Protection (Udp) — versions 10.2, 8.0, 0
Weakness classification (CWE)
References
- support.arcserve.com/s/article/Important-Security-Bulletin-Must-read-for-all-Ar… (vendor-advisory, patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-34521?
- CVE-2025-34521 is a medium-severity vulnerability in Arcserve Udp, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-08-27.
- How severe is CVE-2025-34521?
- Medium severity. CVSS v3 base score is 5.4 out of 10.