8.8

CVE-2022-45451

Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build 30984.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Acronis ≫ Agent SwPlatformwindows Version < c22.10
Acronis ≫ Cyber Protect Version15 Update- SwPlatformwindows
Acronis ≫ Cyber Protect Version15 Updateupdate1 SwPlatformwindows
Acronis ≫ Cyber Protect Version15 Updateupdate2 SwPlatformwindows
Acronis ≫ Cyber Protect Version15 Updateupdate3 SwPlatformwindows
Acronis ≫ Cyber Protect Version15 Updateupdate4 SwPlatformwindows
Acronis ≫ Cyber Protect Version15 Updateupdate5 SwPlatformwindows
Acronis ≫ Cyber Protect Home Office SwPlatformwindows Version < 40173
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.461
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@acronis.com 8.8 2 6
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://security-advisory.acronis.com/SEC-5487
Vendor Advisory
Release Notes