CVE-2023-41749
📋 TL;DR
This vulnerability in Acronis Agent and Cyber Protect for Windows allows attackers to access sensitive system information through excessive data collection. It affects Windows systems running vulnerable versions of these Acronis products. The information disclosure could expose system details that might aid further attacks.
💻 Affected Systems
- Acronis Agent (Windows)
- Acronis Cyber Protect 15 (Windows)
📦 What is this software?
Agent by Acronis
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain detailed system information that could be used for targeted attacks, privilege escalation, or lateral movement within the network.
Likely Case
Unauthorized access to system configuration data, potentially revealing network information, installed software, or system settings.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized access to the vulnerable components.
🎯 Exploit Status
The vulnerability involves accessing an endpoint that collects excessive system information. No authentication bypass is mentioned, but the advisory doesn't specify exact access requirements.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Acronis Agent build 32047 or later, Acronis Cyber Protect 15 build 35979 or later
Vendor Advisory: https://security-advisory.acronis.com/advisories/SEC-5287
Restart Required: Yes
Instructions:
1. Download the latest version from Acronis portal. 2. Install the update on affected systems. 3. Restart the Acronis services or the system as required.
🔧 Temporary Workarounds
Network Access Restriction
windowsRestrict network access to Acronis services to only trusted hosts and networks
Use Windows Firewall to block inbound connections to Acronis Agent ports from untrusted networks
Service Account Hardening
windowsEnsure Acronis services run with minimal necessary privileges
Check service account permissions in Services.msc and reduce to least privilege
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems running vulnerable Acronis products
- Monitor network traffic to/from Acronis services for unusual data collection patterns
🔍 How to Verify
Check if Vulnerable:
Check Acronis Agent version via Control Panel > Programs and Features, or check Cyber Protect version in the application interfaceCheck Version:
For Acronis Agent: Check 'Acronis Agent' version in Programs and Features. For Cyber Protect: Check version in the application dashboard.Verify Fix Applied:
Verify the installed version meets or exceeds the patched build numbers: 32047 for Agent, 35979 for Cyber Protect 15📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Acronis service endpoints
- Large data transfers from Acronis services
Network Indicators:
- Excessive data requests to Acronis service ports
- Unusual connections to Acronis services from unauthorized sources
SIEM Query:
source="acronis*" AND (event_type="data_collection" OR bytes_transferred>threshold) | stats count by src_ip, dest_ip