datto siris virtual firmware vulnerabilities

Latest datto siris virtual firmware CVEs

Newest publication first

1. CVE-2015-9256 Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.

   Published 2018-02-20

   Medium·CVSS 5.3 EPSS 1.0%

   Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.

2. CVE-2015-9255 Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.

   Published 2018-02-20

   Medium·CVSS 5.3 EPSS 1.0%

   Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.

3. CVE-2015-9254 Datto ALTO and SIRIS devices have a default VNC password.

   Published 2018-02-20

   Critical·CVSS 9.8 EPSS 1.1%

   Datto ALTO and SIRIS devices have a default VNC password.

4. CVE-2015-2081 Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

   Published 2018-02-20

   Critical·CVSS 9.8 EPSS 2.8%

   Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.