CVE-2024-34010: Local privilege escalation due to unquoted search path vulnerability

Description

Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True Image (Windows) before build 42386, Acronis True Image OEM (Windows) before build 42575.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 10% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AC

Acronis Cyber Protect 16 · Acronis

before 38690 · source: vendor

AC

Acronis Cyber Protect Cloud Agent · Acronis

before 37758 · source: vendor

AT

Acronis True Image · Acronis

before 42386 · source: vendor

AT

Acronis True Image OEM · Acronis

before 42575 · source: vendor

CP

Cyber Protect Cloud Agent · Acronis

before build_37758 · source: CISA