CVE-2021-27878 Veritas Backup Exec Agent Command Execution
An authentication bypass in Veritas Backup Exec allows attackers to execute arbitrary commands with system privileges.
- Exploited in the wild
- Since 7 Apr 2023
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27878?
CVE-2021-27878 is a high-severity authentication bypass vulnerability in n/a, published on 1 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
Which versions are affected by CVE-2021-27878?
It affects 1 product.
Products include Veritas Backup Exec.
How do I fix CVE-2021-27878?
No fix has been published for CVE-2021-27878 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Apr 2023.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-27878 being exploited?
Yes. Attackers have exploited CVE-2021-27878 in the wild since at least 7 Apr 2023, including in ransomware campaigns.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6r93-82vq-9w4w.