Vulnerability · Published Oct 21, 2020 · Assigned by certcc
CVE-2020-10140
High 7.8
In plain English
A high-severity incorrect permission assignment in True Image from Acronis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 67.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths within C:\ProgramData\Acronis.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acronis | True Image | 2021 – before 32010 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.kb.cert.org/vuls/id/114757 x_refsource_MISC