CVE-2015-7709
critical
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0
Description
The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| arkeia | western_digital_arkeia | {"endIncluding":"11.0.12"} | |
References
- http://www.rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec
- https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/37600/
- http://www.rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec
- https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/37600/
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.