CVE-2022-24113

Published: Feb 4, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287

Affected (11)

Products: Acronis: Agent, Cyber Protect, Cyber Protect Home Office, True Image

Acronis

4 products

Agent

Cyber Protect

Cyber Protect Home Office

True Image

Configuration A

5 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Acronis Agent	Before c21.06
Acronis Cyber Protect	Version 15
Acronis Cyber Protect	Version 15 update1
Acronis Cyber Protect	Version 15 update2
Acronis Cyber Protect Home Office	All versions

Running on/with	Platform Versions
Microsoft Windows	All versions

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Acronis True Image	Version 2021
Acronis True Image	Version 2021 update_1
Acronis True Image	Version 2021 update_2
Acronis True Image	Version 2021 update_3
Acronis True Image	Version 2021 update_4
Acronis True Image	Version 2021 update_5

Related CWEs

CWE-250

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

https://security-advisory.acronis.com/advisories/SEC-2881

Source: security@acronis.com

Vendor Advisory

https://security-advisory.acronis.com/advisories/SEC-2881

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.