CVE-2015-9254
📋 TL;DR
Datto ALTO and SIRIS backup appliances use a default VNC password that is publicly known, allowing attackers to gain remote graphical access to the devices. This affects all devices that haven't changed the default VNC credentials. The vulnerability enables complete system compromise.
💻 Affected Systems
- Datto ALTO
- Datto SIRIS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system takeover with administrative privileges, data exfiltration, ransomware deployment, and use as pivot point into internal networks.
Likely Case
Unauthorized access to backup systems, potential data theft or destruction, and credential harvesting from connected systems.
If Mitigated
Limited impact if VNC is disabled or strong authentication is enforced, though other attack vectors may still exist.
🎯 Exploit Status
Attack requires only VNC client and knowledge of default password. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Specific firmware updates released by Datto (exact version varies by device model)
Vendor Advisory: https://www.datto.com/security/advisories
Restart Required: Yes
Instructions:
1. Log into Datto device management interface 2. Check for firmware updates 3. Apply latest firmware update 4. Restart device 5. Change VNC password to strong unique value
🔧 Temporary Workarounds
Change VNC Password
allChange default VNC password to strong, unique password
Access Datto web interface -> Settings -> VNC -> Change password
Disable VNC Access
allCompletely disable VNC service if not required
Access Datto web interface -> Settings -> VNC -> Disable
🧯 If You Can't Patch
- Change VNC password immediately to strong, unique value
- Restrict network access to VNC port (5900/tcp) using firewall rules
- Monitor VNC authentication logs for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt VNC connection to port 5900 using default password. If connection succeeds, device is vulnerable.Check Version:
Check firmware version in Datto web interface under System -> AboutVerify Fix Applied:
Attempt VNC connection with default password should fail. Verify new password works if VNC is required.📡 Detection & Monitoring
Log Indicators:
- Failed VNC authentication attempts
- Successful VNC logins from unexpected sources
- Multiple VNC connection attempts
Network Indicators:
- VNC traffic (port 5900) from external IPs
- VNC protocol handshakes
- Brute force patterns on VNC port
SIEM Query:
source_port=5900 OR dest_port=5900 | stats count by src_ip, dest_ip