Log in Start free

Actively exploited · Published Mar 1, 2021 · Assigned by mitre

CVE-2021-27876

High 8.1 Exploited Ransomware

In plain English

A high-severity security flaw in Backup Exec Agent from Veritas. Attackers are actively exploiting it in the wild (listed by CISA on April 7, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 13.5% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)13.5%top 3.5% of all CVEs
Exploited in the wildYesCISA KEV since Apr 7, 2023
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 28, 2023.

Official description

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References