CVE-2015-7709

EPSS 79.0%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 79.0%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

10 Jul 2015Metasploit module available

13 Jul 2015Public PoC

05 Oct 2015Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.htmlunverified cve_referencewww.exploit-db.com/exploits/37600/unverified exploitdbwww.exploit-db.com/exploits/37600unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html https://www.exploit-db.com/exploits/37600/http://www.rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec