CVE-2017-16674

Name of the Vulnerable Software and Affected Versions Datto Windows Agent versions 1.0.5.0 and earlier

Description The issue allows unauthenticated remote command execution via a modified command. This can be achieved by combining a malformed primary whitelisted command with a secondary non-whitelisted command. An attacker could exploit this issue to gain unauthenticated access to all agent machines running the affected Datto Windows Agent versions.

Recommendations For Datto Windows Agent versions 1.0.5.0 and earlier, update to a version later than 1.0.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the Datto Windows Agent to minimize the risk of exploitation.