Veritas Backup Exec Agent Vulnerabilities - 20230411002

Overview

Vulnerabilities exist for the Veritas Backup Exec Agent that could be used as part of a ransomware attack. The issues were addressed in 2021 however Veritas urges all customers to immediately update to Backup Exec version 21.2 or later if they have not already done so.

What is the vulnerability?

• Veritas Backup Exec Agent Arbitrary File Access:
• CVE-2021-27876 - CVSS v3 Base Score: =8.1
• Veritas Backup Exec Agent Unauthorized access with SHA authentication:
• CVE-2021-27877 - CVSS v3 Base Score: =9.8
• Veritas Backup Exec Agent Arbitrary Command Execution:
• CVE-2021-27878 - CVSS v3 Base Score: =8.8

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices: Veritas Support

Additional References

• CISA - CISA Adds Five Known Exploited Vulnerabilities to Catalog
• Bleeping Computer - ALPHV ransomware exploits Veritas Backup Exec bugs for initial access