Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Datto Backup Agent can be tricked into unauthorized pairing

CVE-2017-16673 · published 8 years ago
Summary

Versions of the Datto Backup Agent up to 1.0.6.0 accept network connections without checking who is calling. An attacker who can reach the agent on its communication ports could pretend to be a Datto backup appliance and gain control of the agent. Upgrade the agent to a newer version that validates incoming connections, or block the ports from untrusted networks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
datto backup_agent <= 1.0.6.0
cpe:2.3:a:datto:backup_agent:*:*:*:*:*:*:*:*
Original advisory text
Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to thi...
Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified "specific information" by which the agent identifies a network device that is "appearing to be a valid Datto."
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published9 Nov 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-16673 · NVD
Track software like this
Free during beta