CVE-2025-34520CWE-288

CVE-2025-34520

Critical · published August 28, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

⚡ This Arcserve UDP vulnerability lets attackers sneak past the login door without a key! Just by tweaking some request parameters, they can access admin-level features, making it a serious threat. 🔥 Think of it as a hotel where the front desk forgot to check guest IDs. An unauthorized guest could waltz in and access the VIP lounge without anyone batting an eye! If exploited, an attacker could gain unrestricted access to sensitive user accounts and functionality, potentially leading to data manipulation or theft. This could compromise your entire data protection strategy, making it absolutely devastating for your organization!

Put simply

Think of it as a hotel where the front desk forgot to check guest IDs. An unauthorized guest could waltz in and access the VIP lounge without anyone batting an eye! This authentication bypass flaw allows unauthenticated users to manipulate specific request parameters, tricking the system into granting access without valid credentials. It affects all UDP versions prior to 10.2 and is particularly dangerous due to the elevated privileges it enables.

What to do

If exploited, an attacker could gain unrestricted access to sensitive user accounts and functionality, potentially leading to data manipulation or theft. This could compromise your entire data protection strategy, making it absolutely devastating for your organization! To stay protected, make sure to upgrade to Arcserve UDP version 10.2, which includes the necessary patches. If you're running versions 8.0 through 10.1, you'll need to apply the patch or upgrade to 10.2 to close this security gap. For versions 7.x and earlier, it's critical to upgrade to 10.2 as soon as possible! You've got this! Follow these steps to safeguard your data, and you'll have your security hero status activated in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00369 · 29.5th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-08-28T02:15Z
Affected products (5)
ProductVersionsFixed in
arcserve/udp< 7.07.0
arcserve/udp≥ 8.0, < 10.210.2
arcserve/udpall versions—
arcserve/udpall versions—
arcserve/udpall versions—
References (1)
EPSS history
Timeline
  • 27 AUG 21:19Z
    Arcserve UDP < 10.2 Authentication Bypass
    cvelistv5