CVE-2015-2081
9.8
CRITICAL · CVSS 3.0 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.83% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-02-20 |
| Last modified | 2026-06-17 |
Affected (16)
| Vendor | Product |
|---|---|
| datto | alto 2 |
| datto | alto 2 firmware |
| datto | alto 3 |
| datto | alto 3 firmware |
| datto | alto imaged |
| datto | alto imaged firmware |
| datto | alto xl |
| datto | alto xl firmware |
| datto | siris 2 |
| datto | siris 2 firmware |
| datto | siris 3 |
| datto | siris 3 firmware |
| datto | siris 3 x all-flash |
| datto | siris 3 x all-flash firmware |
| datto | siris virtual |
| datto | siris virtual firmware |
References
→ the Explorer · watch your stack · NVD