CVE-2024-49384: low-severity vulnerability in Acronis Cyber Protect 16
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The acep-collector service in Acronis Cyber Protect 16 binds to an unrestricted IP address, expanding its exposure to potential attackers. This increases the attack surface unnecessarily, making the service accessible from more network locations than intended.
The acep-collector service binds to an unrestricted IP address rather than a specific interface, increasing network exposure. An attacker with network access to the system can target the service directly. Mitigation requires updating to build 38690 or later, or restricting network access through firewall rules.
In the same product, most dangerous first.