Vulnerability · Published May 3, 2023 · Assigned by Acronis
CVE-2022-3405
Critical 9.3
In plain English
A critical-severity privilege mismanagement in Acronis Cyber Backup 12.5 from Acronis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.3% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.0)9.3Critical
Exploit odds (30 days)5.3%top 7.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Metasploit
Official description
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acronis | Acronis Cyber Protect 15 | unspecified – before 29486 |
| Acronis | Acronis Cyber Backup 12.5 | unspecified – before 16545 |
Weakness: CWE-269 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N