CVE-2021-43041: 
Kaseya Unitrends Agent vulnerability analysis and mitigation

A format string vulnerability was discovered in Kaseya Unitrends Backup Appliance before version 10.5.5. The vulnerability exists in the privileged vaultServer application, where a crafted HTTP request could induce a format string vulnerability (Vendor Advisory, NVD). The vulnerability was disclosed on December 5, 2021.

The vulnerability is classified as a format string vulnerability (CWE-134) in the vaultServer application. The CVSS v3.1 base score is 8.8 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability could be triggered by sending specially crafted HTTP requests to the vaultServer application (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the vaultServer application, potentially leading to unauthorized access, information disclosure, and system compromise (Vendor Advisory).

The vulnerability has been documented with proof-of-concept exploits. Detailed technical analysis and exploitation techniques have been published by security researchers (CyberOne Part 1, CyberOne Part 2).

Users should immediately update to Unitrends software version 10.5.5 or later to address this vulnerability. The vendor has released patches that fix the format string vulnerability in the vaultServer application (Vendor Advisory).