High · published March 1, 2021
CVSS calls it high at 8.2. It is confirmed in active exploitation. It sits in the 99.2th percentile for exploit probability.
🚨 An outdated authentication scheme could pave the way for attackers to waltz in and execute privileged commands! ⚡ Think of it like a forgotten backdoor in your house that you never locked — it’s just sitting there, inviting trouble for anyone who knows it’s open. In this case, Veritas Backup Exec’s SHA authentication is that backdoor, still functional even when it's not in use! An attacker could exploit this vulnerability to gain unauthorized access to an Agent, allowing them to execute commands with privileges that could compromise your entire backup system. This could lead to critical data loss, system downtime, or even further exploitation of your infrastructure. It's absolutely devastating!
Think of it like a forgotten backdoor in your house that you never locked — it’s just sitting there, inviting trouble for anyone who knows it’s open. In this case, Veritas Backup Exec’s SHA authentication is that backdoor, still functional even when it's not in use! This vulnerability in Veritas Backup Exec before version 21.2 allows remote attackers to exploit an unneeded SHA authentication scheme, which has not been disabled, to gain unauthorized access and execute privileged commands.
An attacker could exploit this vulnerability to gain unauthorized access to an Agent, allowing them to execute commands with privileges that could compromise your entire backup system. This could lead to critical data loss, system downtime, or even further exploitation of your infrastructure. It's absolutely devastating! To safeguard your systems, immediately update Veritas Backup Exec to version 21.2 or later to disable the vulnerable authentication method. Regularly review and audit your installed software for any outdated components. Don't forget to tighten your security policies! You've got this! Follow these steps and you’ll have your defenses fortified in no time! 🛡️