CVE-2024-49387
📋 TL;DR
This vulnerability allows attackers to intercept sensitive information transmitted in cleartext by the acep-collector service in Acronis Cyber Protect 16. Organizations using affected versions on Linux or Windows systems are at risk of data exposure.
💻 Affected Systems
- Acronis Cyber Protect 16
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive backup data, credentials, and system information transmitted by the service, leading to data breaches and potential lateral movement.
Likely Case
Interception of sensitive configuration data, backup metadata, and potentially credentials during normal service operation.
If Mitigated
Limited exposure of non-critical telemetry data if network segmentation and encryption are properly implemented.
🎯 Exploit Status
Exploitation requires network access to intercept cleartext traffic, which is straightforward with tools like Wireshark or tcpdump.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 38690 or later
Vendor Advisory: https://security-advisory.acronis.com/advisories/SEC-7022
Restart Required: Yes
Instructions:
1. Download latest version from Acronis portal. 2. Run installer. 3. Restart affected services. 4. Verify version is 38690+.
🔧 Temporary Workarounds
Network Segmentation
allIsolate acep-collector service traffic to trusted network segments only
VPN/Encryption Tunnel
allForce all acep-collector traffic through encrypted VPN tunnels
🧯 If You Can't Patch
- Implement strict network segmentation to limit acep-collector traffic to trusted segments only
- Deploy network monitoring and IDS/IPS to detect cleartext data transmission attempts
🔍 How to Verify
Check if Vulnerable:
Check Acronis Cyber Protect version in admin console or run 'acronis_cyber_protect --version' on CLICheck Version:
acronis_cyber_protect --versionVerify Fix Applied:
Confirm version is 38690 or higher and monitor network traffic for cleartext acep-collector communication📡 Detection & Monitoring
Log Indicators:
- Unusual network connection patterns to acep-collector ports
- Failed encryption handshake attempts
Network Indicators:
- Cleartext HTTP traffic on acep-collector ports (default 9876)
- Unencrypted sensitive data in packet captures
SIEM Query:
source_port:9876 AND protocol:http AND NOT tls_handshake