8.8

CVE-2023-41743

Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979.

Data is provided by the National Vulnerability Database (NVD)
Acronis ≫ Agent Version < c23.02
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Update-
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Updateupdate1
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Updateupdate2
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Updateupdate3
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Updateupdate4
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Version15 Updateupdate5
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Home Office Version-
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Home Office Version39900
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Home Office Version40107
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Home Office Version40173
   Microsoft ≫ Windows Version-
Acronis ≫ Cyber Protect Home Office Version40208
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.051
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@acronis.com 8.8 2 6
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://security-advisory.acronis.com/SEC-4858
Vendor Advisory
Release Notes