CVE-2024-49384

The acep-collector service in Acronis Cyber Protect 16 binds to an unrestricted IP address, expanding its exposure to potential attackers. This increases the attack surface unnecessarily, making the service accessible from more network locations than intended.

The acep-collector service binds to an unrestricted IP address rather than a specific interface, increasing network exposure. An attacker with network access to the system can target the service directly. Mitigation requires updating to build 38690 or later, or restricting network access through firewall rules.