PT-2024-33497 · Acronis · Acronis Cyber Protect

Published 2024-10-15 · Updated 2025-02-04 · CVE-2024-49383

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 16 versions prior to build 38690

Description The issue is related to an excessive attack surface in the acep-importer service due to binding to an unrestricted IP address. This could potentially lead to system compromise.

Recommendations For Acronis Cyber Protect 16 versions prior to build 38690, upgrade the affected component to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the acep-importer service to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1327

Related Identifiers

CVE-2024-49383

Affected Products

Acronis Cyber Protect

References · 9

• https://security-advisory.acronis.com/advisories/SEC-7285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49383 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49383 · Vendor Advisory
• https://twitter.com/CVEnew/status/1846140031112790074 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846193901339578552 · Twitter Post
• https://twitter.com/oktsec/status/1846168654888480833 · Twitter Post
• https://t.me/cvenotify/109894 · Telegram Post
• https://t.me/cvedetector/7906 · Telegram Post
• https://t.me/cvenotify/98055 · Telegram Post