Arcserve Unified Data Protection Multiple Vulnerabilities

CVE-2023-41998 - Arcserve UDP Unauthenticated RCE 

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

An unauthenticated, remote attacker can execute code remotely via the downloadAndInstallPath() routine within “com.ca.arcflash.rps.webservice.RPSService4CPMImpl.” This routine allows users to upload and execute arbitrary files.

For example, when triggering this method, a malicious actor can cause the service to download a zip file from an attacker-controlled URL to \Engine\BIN\patch\. The zip file is subsequently decompressed and a decompressed EXE file with the same file name as the zip …