Improper Authentication in Backup Exec - CVE-2021-27876
Published: April 5, 2023
Vulnerability identifier: #VU74470
CSH Severity: High
CVSS v4 BT: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2021-27876
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to an error in SHA Authentication scheme. A remote user can use specially crafted input parameters on one of the data management protocol commands to access an arbitrary file on the system using System privileges.
Affected software
Backup Exec
How to mitigate CVE-2021-27876
Install updates from vendor's website.
Backup Exec - update to 21.2