Risk Letters

Exploited vulnerability

CVE-2021-27877

TLP:CLEAR

Veritas Backup Exec Agent Improper Authentication Vulnerability

Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

Facts

  • Vendor: Veritas
  • Product: Backup Exec Agent
  • CVSS: 8.2
  • EPSS (probability of exploitation within 30 days): 64.9 %
  • On CISA's Known Exploited Vulnerabilities list since: 7 April 2023
  • First known exploitation: 7 April 2023
  • Used in ransomware campaigns (per CISA): Yes
  • CISA's deadline for US federal agencies: 28 April 2023
  • Weakness: CWE-287
  • First seen by Risk Letters: 7 April 2023

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD