CVE-2023-41998 Arcserve UDP Unauthenticated RCE
An unauthenticated attacker can upload and execute arbitrary files on Arcserve UDP servers, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41998?
CVE-2023-41998 is a critical vulnerability in Arcserve UDP, published on 27 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.
Weakness: CWE-434
Which versions are affected by CVE-2023-41998?
It affects 1 product.
Products include Arcserve Udp.
How do I fix CVE-2023-41998?
No fix has been published for CVE-2023-41998 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41998 being exploited?
There is no known exploitation of CVE-2023-41998 in the wild and no public exploit code.
Other vulnerabilities in Arcserve UDP
- CVE-2015-4068 Arcserve Unified Data Protection (UDP) Directory Traversal
- CVE-2024-0799 Authentication Bypass via wizardLogin in Arcserve Unified Data Protection
- CVE-2023-41999 Arcserve UDP Management Authentication Bypass
- CVE-2023-42000 Arcserve UDP Agent Unauthenticated Path Traversal File Upload
- CVE-2023-26258 Auth bypass in n/a
Sources
Also known as GHSA-q5h6-hfv2-xr6w.