How severe is CVE-2017-16674?

CVE-2017-16674 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-16674 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-16674?

CVE-2017-16674 affects Datto Windows Agent. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-16674?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-16674 published?

CVE-2017-16674 was published on 2017-11-09 and last updated on 2026-06-17.

CVE-2017-16674

CVE-2017-16674 is a high-severity vulnerability in Datto Windows Agent with a CVSS 3.x base score of 8.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 8.0)
CVSS v2: 4.9
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Datto Windows Agent
Published: 2017-11-09
Last modified: 2026-06-17

Description

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.

Frequently asked questions

What is CVE-2017-16674?: Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.
How severe is CVE-2017-16674?: CVE-2017-16674 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-16674 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-16674?: CVE-2017-16674 affects Datto Windows Agent. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-16674?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-16674 published?: CVE-2017-16674 was published on 2017-11-09 and last updated on 2026-06-17.

References

https://www.datto.com/partner-security-update-nov2017

Affected products (1)

cpe:2.3:a:datto:windows_agent:*:*:*:*:*:*:*:*