Vulnerability · Published Oct 21, 2020 · Assigned by certcc

CVE-2020-10138

High 7.8

In plain English

A high-severity improper access control in Cyber Backup from Acronis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

Affected products (as reported)

Vendor	Product	Versions
Acronis	Cyber Backup	12.5 – before 16363
Acronis	Cyber Protect	15 – before 24600

Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.kb.cert.org/vuls/id/114757 x_refsource_MISC