Arcserve UDP Console 10.3 contains a vulnerability involving an incorrectly specified destination in a communication channel. Specifically, if a user sets the activation server hostname to a dummy URL, the product may send communications to that unintended domain, potentially leading to information disclosure. The CVSS 3.0 base score is 6.3, reflecting a network attack vector with low complexity and no privileges required, but user interaction is needed. The impact includes limited confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information available at this time.

The vulnerability can cause the UDP Console to unintentionally communicate with a dummy domain specified by the user, which may result in information disclosure. The CVSS score indicates a medium impact with limited confidentiality, integrity, and availability consequences. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid configuring the activation server hostname to dummy or untrusted URLs to prevent unintended communications and potential information disclosure.