CVE-2021-43042: 
Kaseya Unitrends Agent vulnerability analysis and mitigation

An issue was discovered in Kaseya Unitrends Backup Appliance before version 10.5.5, identified as CVE-2021-43042. A buffer overflow vulnerability existed in the vaultServer component, which was exploitable by a remote unauthenticated attacker. The vulnerability was disclosed and patched in December 2021 (Kaseya Advisory).

The vulnerability is classified as a buffer overflow in the vaultServer component with a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-120 (Buffer Copy without Checking Size of Input) (NVD).

The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected system through the vaultServer component. Given the CVSS score of 9.8, this represents a critical security risk with potential for complete system compromise (Kaseya Advisory).

The vulnerability is exploitable remotely by an unauthenticated attacker. Detailed technical analysis and proof-of-concept exploits have been published demonstrating the vulnerability's exploitation potential (CyberOne Blog).

The vulnerability has been patched in Kaseya Unitrends Backup Appliance version 10.5.5. Users should immediately update to this version or later to mitigate the risk. The vendor strongly recommends not exposing the client ports directly to the Internet and internally (Kaseya Advisory).