📦

udp

Vendor: arcserve

Login to add this product to WatchStack
Actively Exploited 1 CISA KEV List
PoC / Exploits 1 Code Available
Total RCEs 2 Remote Access
Total CVEs 24 Total Indexed
Avg. EPSS 10.86% Exploit Prob.
Latest CVE CVE-2025-34523 Aug 27

Security Vulnerability Index

Page 2 / 3
9.8 CVSS
CVE-2023-26258
Exploit Found

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

EPSS: 37.71%
6.1 CVSS
CVE-2018-18660

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.

EPSS: 0.90%
7.5 CVSS
CVE-2018-18659

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.

EPSS: 1.83%
7.5 CVSS
CVE-2018-18658

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclosure via /UDPUpdates/Config/FullUpdateSettings.xml issue.

EPSS: 1.34%
7.5 CVSS
CVE-2018-18657

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue.

EPSS: 1.34%
9.1 CVSS
CVE-2015-4068

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

EPSS: 63.64%