Improper Authentication in Backup Exec - CVE-2021-27876
Published: April 5, 2023
Vulnerability identifier: #VU74470
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2021-27876
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: Veritas Technologies
Affected software:
Backup Exec
Backup Exec
Detailed vulnerability description
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to an error in SHA Authentication scheme. A remote user can use specially crafted input parameters on one of the data management protocol commands to access an arbitrary file on the system using System privileges.
How to mitigate CVE-2021-27876
Install updates from vendor's website.