Actively exploited in the wild
Veritas Backup Exec Agent Command Execution Vulnerability
Veritas - Backup Exec Agent · Listed in the CISA KEV since 2023-04-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-27878
HighCVSS 8.8KEVSummary
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and execute arbitrary commands with system privileges.
Risk Assessment
An attacker could take control of the system by executing arbitrary commands with system privileges, leading to full compromise.
Recommendation
Update Veritas Backup Exec to version 21.2 or later.
Other vulnerabilities in Veritas Backup Exec
See all- CVE-2021-27877HighActively exploited
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2, which had not been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
- CVE-2021-27876HighActively exploited
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and, using crafted input parameters, access an arbitrary file on the system with System privileges.
- CVE-2017-8895Critical
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.
Original NVD description (English source)
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.