PT-2025-3129 · Acronis · Acronis Cyber Protect Cloud Agent+1

Published 2025-01-02 · Updated 2025-01-03 · CVE-2024-55542

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 16 versions prior to build 39169 Acronis Cyber Protect Cloud Agent versions prior to build 35895

Description The issue is related to local privilege escalation due to excessive permissions assigned to the Tray Monitor service. This allows for an escalation of privileges locally.

Recommendations For Acronis Cyber Protect 16 versions prior to build 39169, update to a version after build 39169 to resolve the issue. For Acronis Cyber Protect Cloud Agent versions prior to build 35895, update to a version after build 35895 to resolve the issue. As a temporary workaround, consider restricting access to the Tray Monitor service until a patch is available.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-02179

CVE-2024-55542

Affected Products

Acronis Cyber Protect 16

Acronis Cyber Protect Cloud Agent

References · 7

• https://security-advisory.acronis.com/advisories/SEC-5342 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02179 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55542 · Security Note
• https://twitter.com/CVEnew/status/1875033748531540375 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1874926479173140775 · Twitter Post
• https://t.me/cvenotify/106018 · Telegram Post
• https://t.me/cvedetector/14175 · Telegram Post