High severity · published Apr 26, 2024
CVE-2024-33673
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
Backup Exec · Veritas
21.0 before 23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33673
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33673
Vendor Advisory
https://www.veritas.com/support/en_US/security/VTS24-002#H2
More from Backup Exec
9.8
CVE-2021-27877
Veritas Backup Exec Agent Improper Authentication Vulnerability
8.8
CVE-2021-27878
Veritas Backup Exec Agent Command Execution Vulnerability
8.1
CVE-2021-27876
Veritas Backup Exec Agent File Access Vulnerability
9.8
CVE-2017-8895
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can…
8.8
CVE-2020-36167
An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517