Medium severity · published Jan 2, 2025
CVE-2024-55538
Sensitive information disclosure due to missing authentication
4.0
CVSS
0.2%
EPSS
No
On KEV
Description
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before build 42571, Acronis True Image OEM (Windows) before build 42575.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Acronis True Image · Acronis
before 41725; before 41736 · source: vendor
AT
Acronis True Image OEM · Acronis
before 42571; before 42575 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-55538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-55538
security-advisory.acronis.com
https://security-advisory.acronis.com/advisories/SEC-2209
More from Acronis True Image
8.8
CVE-2025-7779
Local privilege escalation due to insecure XPC service configuration
7.8
CVE-2026-33092
Local privilege escalation due to improper handling of environment variables
7.8
CVE-2026-28727
Local privilege escalation due to insecure Unix socket permissions
7.3
CVE-2025-11178
Local privilege escalation due to DLL hijacking vulnerability
6.7
CVE-2026-33271
Local privilege escalation due to insecure folder permissions