PT-2022-27518 · Microsoft+1 · Windows+4

Alfarom256 · Published 2022-11-17 · Updated 2023-09-06 · CVE-2022-45451

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Home Office (Windows) versions prior to build 40173 Acronis Agent (Windows) versions prior to build 30600 Acronis Cyber Protect 15 (Windows) versions prior to build 30984

Description The issue is related to local privilege escalation due to insecure driver communication port permissions.

Recommendations For Acronis Cyber Protect Home Office (Windows) versions prior to build 40173, update to build 40173 or later. For Acronis Agent (Windows) versions prior to build 30600, update to build 30600 or later. For Acronis Cyber Protect 15 (Windows) versions prior to build 30984, update to build 30984 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-45451

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

Acronis Cyber Protect Home Office

Windows

References · 10

• 🔥 https://github.com/alfarom256/CVE-2022-45451 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45451 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-4858 · Vendor Advisory
• https://security-advisory.acronis.com/SEC-5487 · Vendor Advisory
• https://t.me/cibsecurity/69548 · Telegram Post
• https://security-advisory.acronis.com/advisories/SEC-5487 · Note
• https://t.me/proxy_bar/1223 · Telegram Post
• https://t.me/cybersecuritytechnologies/7371 · Telegram Post
• https://twitter.com/geekphane/status/1699461071583555655 · Twitter Post