Vulnerability · Published Nov 27, 2023 · Assigned by tenable
CVE-2023-41998Arcserve UDP Unauthenticated RCE
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Arcserve UDP from Arcserve. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.3% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)15.3%top 3.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arcserve | Arcserve UDP | 0 – before 9.2 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H