CVE-2022-46869
📋 TL;DR
This vulnerability allows local attackers to escalate privileges during installation of Acronis Cyber Protect Home Office on Windows systems. Attackers can exploit improper handling of symbolic links to gain elevated system permissions. Only Windows users running vulnerable versions of this specific Acronis product are affected.
💻 Affected Systems
- Acronis Cyber Protect Home Office
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM/administrator privileges, enabling complete system compromise, data theft, malware installation, and persistence establishment.
Likely Case
Local user with limited privileges gains administrative access to install unauthorized software, modify system settings, or access protected data.
If Mitigated
With proper user access controls and limited local user privileges, impact is contained to the compromised user account only.
🎯 Exploit Status
Exploitation requires local access and knowledge of symbolic link manipulation techniques. The vulnerability is in the installation process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 40278 or later
Vendor Advisory: https://security-advisory.acronis.com/advisories/SEC-3835
Restart Required: Yes
Instructions:
1. Download latest version from Acronis website. 2. Uninstall current version. 3. Install updated version (build 40278+). 4. Restart system.
🔧 Temporary Workarounds
Restrict local user privileges
windowsLimit standard user accounts to prevent exploitation attempts
Monitor installation processes
windowsImplement application control to monitor and restrict installation activities
🧯 If You Can't Patch
- Restrict physical and remote access to vulnerable systems
- Implement strict user privilege management and monitor for unusual installation activities
🔍 How to Verify
Check if Vulnerable:
Check Acronis Cyber Protect Home Office version in program settings or Control Panel > Programs and FeaturesCheck Version:
wmic product where name='Acronis Cyber Protect Home Office' get versionVerify Fix Applied:
Verify installed version is build 40278 or higher in program settings📡 Detection & Monitoring
Log Indicators:
- Unusual installation processes, symbolic link creation events, privilege escalation attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 OR EventID=4689 with process name containing 'Acronis' AND target process with elevated privileges