Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Datto

First CVE: Nov 9, 2017Active for: 9 yearsTotal CVEs: 6

Datto's vulnerability profile centers on a narrow but high-value product line of backup and disaster-recovery appliances—including the Alto Imaged, Alto XL, and Siris 2 series—that are widely deployed in managed service provider and small-to-medium business environments. Its disclosures skew strongly toward critical-severity outcomes and recur through weakness classes including sensitive information exposure, hard-coded credentials, and improper input validation, reflecting risks inherent to appliances that store and manage customer data at scale. Defenders should prioritize Datto appliance patching and restrict administrative access; current severity, exploitation, and exposure counts are shown alongside this summary.

FAUCET AI Generated
6
Total CVEs
More Total CVEs than 86% of tracked vendors
0.2
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 1% of tracked vendors
7.3
Avg CVSS Score
Higher Avg CVSS Score than 54% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Datto over time

Volume of CVEsAvg CVSS Base Score
First CVE
Nov 9, 2017
8 years ago
Most Recent CVE
Feb 20, 2018
3,076 days ago

Products(18 total)

Top CVEs

Signals from CVEs in this vendor scope (6 CVEs).

6 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2015-2081CRITICAL
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Feb 20, 20189.830NONO
CVE-2015-9254CRITICAL
Datto ALTO and SIRIS devices have a default VNC password.
Feb 20, 20189.829NONO
CVE-2017-16674HIGH
Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary w
Nov 9, 20178.026NONO
CVE-2017-16673MEDIUM
Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issu
Nov 9, 20175.320NONO
CVE-2015-9256MEDIUM
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Feb 20, 20185.315NONO
CVE-2015-9255MEDIUM
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtua
Feb 20, 20185.315NONO
View all 6 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products6 CVEs
50%
17%
33%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network4 (66.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network2 (33.3%)
Attack Complexity
Low4 (66.7%)
High2 (33.3%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low1 (16.7%)
High0 (0.0%)
None5 (83.3%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (6 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Datto.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Datto — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Datto's Products

View all 1 CNAs →

Top CWEs