CVE-2021-27878

Related Files

Veritas Backup Exec Agent Remote Code Execution

Posted Sep 26, 2022

Authored by Alexander Korotin | Site metasploit.com

Veritas Backup Exec Agent supports multiple authentication schemes and SHA authentication is one of them. This authentication scheme is no longer used within Backup Exec versions, but had not yet been disabled. An attacker could remotely exploit the SHA authentication scheme to gain unauthorized access to the BE Agent and execute an arbitrary OS command on the host with NT AUTHORITY\SYSTEM or root privileges depending on the platform. The vulnerability presents in 16.x, 20.x and 21.x versions of Backup Exec up to 21.2 (or up to and including Backup Exec Remote Agent revision 9.3).

tags | exploit, remote, arbitrary, root

advisories | CVE-2021-27876, CVE-2021-27877, CVE-2021-27878

SHA-256 | 5d2a9879ee25f3f36daab21dabc7454caa668fe4871c215806df28dda8ea3890

Download | Favorite | View