This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis Cyber Protect Cloud Agent fixes 2 vulnerabilities
Acronis Cyber Protect Cloud Agent for Windows version C25.04 fixes 2 vulnerabilities [1][2].
Allows an authenticated local attacker, due to insecure folder permissions, to elevate their privileges [1].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent;
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-30408 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 24. 4. 2025.
Allows an authenticated local attacker, due to unrestricted resource allocation, to carry out a DoS attack [2].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-30409 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 24. 4. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 25. 4. 2025.