CVE-2023-41743
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Acronis products for Windows. It allows a local low-privileged user to gain SYSTEM-level privileges by exploiting insecure driver communication port permissions. Affected users include anyone running vulnerable versions of Acronis Cyber Protect Home Office, Acronis Agent, or Acronis Cyber Protect 15 on Windows systems.
💻 Affected Systems
- Acronis Cyber Protect Home Office (Windows)
- Acronis Agent (Windows)
- Acronis Cyber Protect 15 (Windows)
📦 What is this software?
Agent by Acronis
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access can achieve full SYSTEM privileges, enabling complete system compromise, installation of persistent malware, credential theft, and lateral movement within the network.
Likely Case
Malicious local users or malware with initial foothold can escalate privileges to bypass security controls, disable security software, and maintain persistence on compromised systems.
If Mitigated
With proper patching and least privilege principles, impact is limited to denial of service at the application level without system-wide compromise.
🎯 Exploit Status
Exploitation requires local access but is considered low complexity once local access is obtained. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Acronis Cyber Protect Home Office build 40278+, Acronis Agent build 31637+, Acronis Cyber Protect 15 build 35979+
Vendor Advisory: https://security-advisory.acronis.com/SEC-4858
Restart Required: Yes
Instructions:
1. Open Acronis application. 2. Check for updates in settings. 3. Install available updates. 4. Restart the system to complete installation.
🔧 Temporary Workarounds
Restrict local user access
windowsLimit local user accounts to only trusted personnel and implement strict access controls to reduce attack surface.
Monitor driver communication
windowsImplement monitoring for unusual driver communication patterns or unauthorized attempts to access driver ports.
🧯 If You Can't Patch
- Remove Acronis products from critical systems until patching is possible
- Implement application whitelisting to prevent unauthorized processes from interacting with Acronis drivers
🔍 How to Verify
Check if Vulnerable:
Check Acronis application version in settings or control panel and compare with patched versions listed in advisory.Check Version:
Check Acronis application GUI or run: wmic product where "name like '%Acronis%'" get name, versionVerify Fix Applied:
Verify installed version matches or exceeds patched build numbers: Home Office ≥40278, Agent ≥31637, Cyber Protect 15 ≥35979.📡 Detection & Monitoring
Log Indicators:
- Unusual driver loading events
- Failed privilege escalation attempts in security logs
- Suspicious process creation from Acronis services
Network Indicators:
- Local inter-process communication anomalies
- Unexpected driver port access
SIEM Query:
EventID=4688 AND (ProcessName LIKE '%acronis%' OR ParentProcessName LIKE '%acronis%') AND NewProcessName='cmd.exe' OR NewProcessName='powershell.exe'