This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis fixes 5 vulnerabilities in its products
Acronis fixes 5 vulnerabilities in Acronis Cyber Protect 16 and Acronis Cyber Protect Cloud Agent. The fixed versions can be found in the links for the individual vulnerabilities [1][2][3][4][5].
An unauthenticated remote attacker can perform a DoS attack due to improper handling of malformed input in Acronis Cyber Protect Cloud Agent [1].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent; <build 40077
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-30415 at cve.org, NVD
- CWE-1286: Improper Validation of Syntactic Correctness of Input at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2025.
An authenticated local attacker can escalate their privileges due to insecure folder permissions in Acronis Cyber Protect 16 [2].
The vulnerability is present in product:
- Acronis Cyber Protect 16; <build 39938
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-48961 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2025.
An authenticated local attacker can escalate their privileges due to insecure folder permissions in Acronis Cyber Protect Cloud Agent [3].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent; <build 40077
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-48959 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2025.
An unauthenticated attacker on the local network can decrypt data due to a weak server key used for TLS encryption in Acronis Cyber Protect 16 [4].
The vulnerability is present in product:
- Acronis Cyber Protect 16; <build 39938
CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
More information:
- CVE-2025-48960 at cve.org, NVD
- CWE-326: Inadequate Encryption Strength at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2025.
An authenticated remote attacker can perform an SSRF attack in Acronis Cyber Protect 16 and gain access to sensitive information [5].
The vulnerability is present in product:
- Acronis Cyber Protect 16; <build 39938
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-48962 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 4. 6. 2025.
Links
- [1] https://security-advisory.acronis.com/advisories/SEC-8646
- [2] https://security-advisory.acronis.com/advisories/SEC-8000
- [3] https://security-advisory.acronis.com/advisories/SEC-8133
- [4] https://security-advisory.acronis.com/advisories/SEC-6403
- [5] https://security-advisory.acronis.com/advisories/SEC-8514
By CESNET, z.s.p.o. Michaela Jarošová on 6. 6. 2025.