CVE-2021-27876
Published · Updated
91Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 8.1epss 14%
from disclosure to weapon1935 days
Published on NVDMar 1
1st PoC+1935d
metasploitMar 1
CISA KEV+767d
exploitation probability
14%top 4% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2023-04-28
Apply updates per vendor instructions.
In short
Veritas Backup Exec has a flaw in its authentication system that allows attackers to bypass security checks and gain unauthorized access. Once inside, they can read or manipulate any file on the system with high-level privileges.
Technical detail
The SHA Authentication scheme in Veritas Backup Exec's client-agent communication is vulnerable to authentication bypass over TLS. An attacker can circumvent authentication, execute data management protocol commands, and leverage crafted input parameters to achieve arbitrary file access with System privileges.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:N
Affected products
n/a · n/apublic PoCs found — 4
githubgithub.com/wingerbijay/CVE-2021-27876★ 1cve_referencepacketstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/91dae76df466unverifiedvulncheckvulncheck.com/xdb/83ee2377b9d6unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.