CVE-2023-41746CWE-20

Remote command execution due to improper input validation

High · published August 31, 2023

CVSS v3.0
8.0
EPSS
1%
Percentile
69.9
In the wild
Unconfirmed
What it is

⚡ An improperly validated input unlocks the door to remote command execution in Acronis Cloud Manager! 🔥 Think of it like a restaurant that doesn’t double-check orders before serving—an eager waiter delivers a dish that isn’t what the customer asked for, leading to chaos in the kitchen! An attacker could remotely execute any command on the server, giving them the potential to manipulate or steal data and disrupt services. This could be absolutely devastating, especially if sensitive information is at stake!

Put simply

Think of it like a restaurant that doesn’t double-check orders before serving—an eager waiter delivers a dish that isn’t what the customer asked for, leading to chaos in the kitchen! This vulnerability arises from insufficient input validation, allowing attackers to craft malicious commands that the Acronis Cloud Manager executes without confirmation. Essentially, it’s like sending a fake order that the system accepts without questioning.

What to do

An attacker could remotely execute any command on the server, giving them the potential to manipulate or steal data and disrupt services. This could be absolutely devastating, especially if sensitive information is at stake! To secure your system, update Acronis Cloud Manager to build 6.2.23089.203 or higher immediately. Additionally, review input validation processes across your applications to ensure they are airtight! You’ve got this! Following these steps will help you secure your system and keep the bad guys out! 🛡️

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01287 · 69.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-08-31T17:53Z
EPSS history
Timeline
  • 31 AUG 17:53Z
    Remote command execution due to improper input validation
    cvelistv5