PT-2023-5802 · Acronis · Acronis Cyber Protect Home Office

Imag0R · Published 2023-08-31 · Updated 2024-09-19 · CVE-2022-46869

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect Home Office versions before build 40278

Description The issue is related to improper soft link handling, which can lead to local privilege escalation during installation. This allows an attacker to elevate their privileges.

Recommendations For Acronis Cyber Protect Home Office versions before build 40278, update to build 40278 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation process to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Link Following

Weakness Enumeration

CWE-269

CWE-59

CWE-610

Related Identifiers

BDU:2023-06488

CVE-2022-46869

Affected Products

Acronis Cyber Protect Home Office

References · 6

• https://bdu.fstec.ru/vul/2023-06488 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-3835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46869 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46869 · Vendor Advisory
• https://t.me/cvenotify/95350 · Telegram Post
• https://t.me/cibsecurity/69600 · Telegram Post