CVE-2008-4397: CA ARCserve Backup RPC interface directory traversal enables remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with a network-reachable, unauthenticated RPC path to arbitrary command execution on a high-value backup server, plus a very high EPSS score, warrants immediate remediation despite the absence of KEV listing.

What it is

The RPC interface exposed by asdbapi.dll in CA ARCserve Backup r11.1 through r12.0 fails to validate path input, allowing a .. (dot dot) sequence in an RPC call with opnum 0x10A to traverse directories. Because the same interface permits command execution, this input validation flaw can be turned into remote code execution on the backup server. Backup servers are high-value targets holding credentials and data, so this matters even though the product line is legacy.

Impact

A remote, unauthenticated attacker can execute arbitrary commands with the privileges of the affected service, leading to full compromise of the backup server. From there an attacker can reach stored backup data and potentially pivot into the wider environment.

Attack surface

Reached over the network through the RPC interface implemented by asdbapi.dll, per the CVSS 2.0 vector AV:N/AC:L/Au:N, meaning no authentication and no user interaction are required. The only precondition is network access to the RPC endpoint on a vulnerable ARCserve Backup installation.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use, but EPSS is very high (0.80542, 99.6th percentile), indicating strong predicted exploitation activity. No public exploit code is confirmed by the supplied reference tags, which are advisory and patch links only.

What to do

• Apply the vendor patch referenced in the CA support advisory (contentID=188143) or upgrade off the affected r11.1 through r12.0 releases.
• Restrict network access to the ARCserve Backup RPC interface to trusted management hosts using firewall rules or network segmentation.
• If the product is no longer supported or cannot be patched, isolate or decommission the affected backup server.
• Monitor and alert on unexpected RPC traffic to the backup server from untrusted network segments.

Detection

• Inspect RPC traffic to the ARCserve Backup host for calls using opnum 0x10A that contain .. (dot dot) sequences in path parameters.
• Alert on child processes spawned by the ARCserve Backup service (asdbapi.dll host process) that are not part of normal backup operations.
• Review backup server logs and host telemetry for anomalous file access outside expected backup directories.
• Correlate network connections to the RPC endpoint with process creation events on the backup server to catch post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.