CVE-2011-3011: CA ARCserve D2D r15 session handling flaw exposes credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCredential theft leading to arbitrary command execution over an unauthenticated network vector, with public exploit references and very high EPSS, outweighs the medium CVSS 2.0 base score.

What it is

BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, allowing remote attackers to obtain credentials. Because those credentials can then be used to execute arbitrary commands, the flaw is more serious than a simple information leak. The record does not specify the exact vectors or which credentials are exposed.

Impact

An attacker gains access to credentials and can use them to execute arbitrary commands on the affected system. The CVSS 2.0 vector rates only partial confidentiality impact, but the description indicates command execution follows credential theft.

Attack surface

Reachable over the network with no authentication required, per the AV:N/Au:N vector. No user interaction is indicated in the record, and the specific request path is unspecified.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71631 (99th percentile), and one SecurityFocus reference carries an Exploit tag, indicating public exploit material exists. No ransomware association is documented.

What to do

• Apply the vendor fix referenced in the CA support advisory for ARCserve D2D r15.
• If patching is not immediately possible, restrict network access to the ARCserve D2D service to trusted management hosts only.
• Rotate any credentials that may have been exposed through the affected service.
• Monitor and audit accounts used by ARCserve D2D for unexpected command execution or logon activity.

Detection

• Review ARCserve D2D service logs for anomalous session creation or credential retrieval activity.
• Alert on unexpected processes or command execution spawned by the ARCserve D2D service account.
• Monitor network access to the ARCserve D2D service from hosts outside the expected management subnet.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.