Privilege Escalation Vulnerability in Acronis Cyber Backup and Cyber Protect

CVE-2020-10138

What is CVE-2020-10138?

A vulnerability in Acronis Cyber Backup 12.5 and Cyber Protect 15 arises from a misconfigured OpenSSL component that allows unprivileged Windows users to exploit the OPENSSLDIR variable. By creating a subdirectory in the path specified, users can introduce a crafted openssl.cnf file, potentially enabling arbitrary code execution with SYSTEM privileges. This poses significant risks, as it could lead to unauthorized access and control over the affected systems.

References