CVE-2021-27877 Veritas Backup Exec Agent Improper Authentication
Attackers can exploit a deprecated SHA authentication scheme in Veritas Backup Exec to gain unauthorized access and execute privileged commands.
- Exploited in the wild
- Since 7 Apr 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27877?
CVE-2021-27877 is a high-severity authentication bypass vulnerability in n/a, published on 1 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
Which versions are affected by CVE-2021-27877?
It affects 1 product.
Products include Veritas Backup Exec.
How do I fix CVE-2021-27877?
No fix has been published for CVE-2021-27877 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Apr 2023.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-27877 being exploited?
Yes. Attackers have exploited CVE-2021-27877 in the wild since at least 7 Apr 2023, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-grhg-3w4v-cp2r.