CVE-2022-45451
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Acronis products for Windows. It allows a local attacker with low privileges to gain SYSTEM-level access due to insecure driver communication port permissions. Affected users include those running vulnerable versions of Acronis Cyber Protect Home Office, Acronis Agent, or Acronis Cyber Protect 15 on Windows systems.
💻 Affected Systems
- Acronis Cyber Protect Home Office (Windows)
- Acronis Agent (Windows)
- Acronis Cyber Protect 15 (Windows)
📦 What is this software?
Agent by Acronis
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access can achieve full SYSTEM privileges, enabling complete system compromise, data theft, persistence mechanisms, and disabling of security controls.
Likely Case
Malware or malicious users with initial access can escalate privileges to bypass security restrictions, install additional malware, or access protected system resources.
If Mitigated
With proper access controls and least privilege principles, impact is limited to the compromised user account only.
🎯 Exploit Status
Exploitation requires local access but is considered low complexity once initial access is obtained. The vulnerability is in driver communication mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Acronis Cyber Protect Home Office build 40173+, Acronis Agent build 30600+, Acronis Cyber Protect 15 build 30984+
Vendor Advisory: https://security-advisory.acronis.com/SEC-5487
Restart Required: Yes
Instructions:
1. Open Acronis product. 2. Check for updates in settings. 3. Apply available updates. 4. Restart the system as prompted. 5. Verify the updated version is running.
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to vulnerable systems to trusted users only
Remove vulnerable software
windowsUninstall affected Acronis products if not essential
Control Panel > Programs > Uninstall a program > Select Acronis product > Uninstall
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into affected systems
- Monitor for unusual privilege escalation attempts and driver communication anomalies
🔍 How to Verify
Check if Vulnerable:
Check Acronis product version in the application interface or via 'wmic product get name,version' command and compare with vulnerable versionsCheck Version:
wmic product where "name like '%Acronis%'" get name,versionVerify Fix Applied:
Verify the installed version meets or exceeds the patched build numbers: Home Office 40173+, Agent 30600+, Cyber Protect 15 30984+📡 Detection & Monitoring
Log Indicators:
- Unusual driver loading events
- Privilege escalation attempts in Windows Security logs
- Acronis service anomalies
Network Indicators:
- Local inter-process communication anomalies on driver ports
SIEM Query:
EventID=4688 AND (NewProcessName LIKE '%Acronis%' OR ParentProcessName LIKE '%Acronis%') AND SubjectUserName!=SYSTEM