This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Acronis Cyber Protect 16 fixes 6 vulnerabilities

Acronis Cyber Protect 16 build 39169 fixes 6 vulnerabilities.

Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55543)
CVSS 7.3 (High)

An authenticated local attacker can elevate their privileges through a DLL hijacking vulnerability [1].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 1. 2025.

Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55540)
CVSS 6.6 (Medium)

An authenticated local attacker can elevate their privileges through a DLL hijacking vulnerability [2].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 2. 1. 2025.

Acronis Cyber Protect 16 - missing session invalidation (CVE-2024-56413)
CVSS 6.1 (Medium)

An authenticated attacker on the local network can exploit the missing session invalidation after a user is removed [3].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 2. 1. 2025.

Acronis Cyber Protect 16 - use of weak hash (CVE-2024-56414)
CVSS 5.5 (Medium)

An authenticated local attacker can exploit a weak hash algorithm in the integrity check of the web installer [4].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

More information:

The vulnerability was publicly disclosed 2. 1. 2025.

Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55542)
CVSS 4.4 (Medium)

An authenticated local attacker can elevate their privileges due to excessive permissions assigned to the Tray Monitor service [5].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 2. 1. 2025.

Acronis Cyber Protect 16 - stored cross-site scripting (CVE-2024-55541)
CVSS 3.1 (Low)

An unauthenticated remote attacker can carry out an XSS attack due to missing origin validation in postMessage [6].

The vulnerability is present in product:

  • Acronis Cyber Protect 16; <39169

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

More information:

  • CVE-2024-55541 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 1. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 6. 1. 2025.

CESNET, z.s.p.o. Logo