High severity · published Aug 31, 2023
CVE-2023-41743
Local privilege escalation due to insecure driver communication port permissions
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979, Acronis True Image OEM (Windows) before build 42575.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Agent · Acronis
before c23.02 · source: NVD
CP
Cyber Protect · Acronis
15; 15; 15; 15; 15; 15 · source: NVD
CP
Cyber Protect Home Office · Acronis
39900; 40107; 40173; 40208 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41743
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41743
Release Notes
https://security-advisory.acronis.com/SEC-4858
Release Notes
https://security-advisory.acronis.com/advisories/SEC-5487
More from Agent
7.8
CVE-2026-28727
Local privilege escalation due to insecure Unix socket permissions
7.8
CVE-2023-44209
Local privilege escalation due to improper soft link handling
7.8
CVE-2023-41744
Local privilege escalation due to unrestricted loading of unsigned libraries
7.8
CVE-2022-45451
Local privilege escalation due to insecure driver communication port permissions
7.8
CVE-2022-45452
Local privilege escalation due to insecure folder permissions