CVE-2021-27877: Veritas Backup Exec Agent Improper Authentication Vulnerability
First published: Mon Mar 01 2021(Updated: )
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Veritas Backup Exec | <21.2 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-27877?
CVE-2021-27877 has been classified with medium severity due to its potential for remote code execution.
How do I fix CVE-2021-27877?
To remediate CVE-2021-27877, upgrade Veritas Backup Exec to version 21.2 or a later version.
Who is affected by CVE-2021-27877?
CVE-2021-27877 affects users of Veritas Backup Exec versions prior to 21.2 that still utilize the SHA authentication scheme.
What kind of vulnerability is CVE-2021-27877?
CVE-2021-27877 is a remote code execution vulnerability related to outdated authentication support.
Is there a known exploit for CVE-2021-27877?
Yes, there are known exploits for CVE-2021-27877 that take advantage of the vulnerable SHA authentication scheme.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/description
- agent/title
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/first-publish-date
- agent/event
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/source
- vendor/veritas
- canonical/veritas backup exec
- canonical/veritas backup exec agent