CVE-2024-49383: low-severity vulnerability in Acronis Cyber Protect 16
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The acep-importer service listens on all network interfaces instead of just localhost, allowing anyone on the network to potentially access it. This unnecessarily exposes the service to attacks that could otherwise be prevented by limiting who can connect.
The acep-importer service binds to an unrestricted IP address (0.0.0.0), expanding the attack surface by exposing the service to unauthenticated network access. This configuration increases the potential for network-based exploitation and abuse, particularly in multi-tenant or untrusted network environments. Mitigation requires binding to restricted IP addresses or implementing network segmentation controls.
In the same product, most dangerous first.