CVEs / CVE-2021-27878
CVE-2021-27878: Veritas Backup Exec Agent Command Execution Vulnerability
- Known exploited in the CISA KEV catalog since 7 Apr 2023
- high 8.8 CVSS 3.1 (NVD)
- EPSS 23.9% chance of exploitation in the next 30 days, higher than 97% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-27878
Summary
Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
Description
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 7 Apr 2023 |
|---|---|
| Due date for US federal agencies | 28 Apr 2023 |
| Used in ransomware campaigns | Known |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|
References
- CVE-2021-27878 on NVD
- CVE-2021-27878 in the CISA KEV catalog
- https://www.veritas.com/support/en_US/security/VTS21-001 (cited by CISA)
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27878 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.