Arcserve UDP Console has a flaw that allows the activation server hostname to be set to an incorrect or dummy URL. When this occurs, the product will communicate with the unintended domain and can expose internal information through that channel. The weakness stems from using untrusted input to control the destination of a communication channel, as identified by CWE-941.

The vulnerability affects the Arcserve UDP Console product. No specific version numbers are provided in the advisory, so all releases of Arcserve UDP Console that allow external activation server configuration are potentially impacted.

The CVSS score of 5.1 indicates a moderate risk level. Exploitability is unclear because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker must gain the ability to alter the activation server hostname, which likely requires privileged access to the console or compromise of configuration files. The impact is information disclosure rather than code execution or denial of service, limiting the scope but still posing a confidentiality risk.