CVE-2024-55543
Published: 02 January 2025
Summary
CVE-2024-55543 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Acronis Cyber Protect. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL Side-Loading (T1574.002); ranked at the 22.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the DLL hijacking vulnerability by requiring timely application of the vendor patch to Acronis Cyber Protect build 39169 or later.
Enforces secure configuration settings such as Windows safe DLL search order to prevent loading of malicious DLLs from untrusted paths.
Limits the privileges of Acronis Cyber Protect processes to the minimum necessary, reducing the impact and feasibility of privilege escalation via DLL hijacking.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct DLL hijacking (CWE-427) enables local privilege escalation via search order/side-loading abuse.
NVD Description
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Deeper analysisAI
CVE-2024-55543 is a local privilege escalation vulnerability stemming from DLL hijacking, classified under CWE-427. It affects Acronis Cyber Protect 16 for Windows in versions prior to build 39169. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-01-02.
A local attacker requires no privileges (PR:N) but needs low-complexity attack steps (AC:L) and user interaction (UI:R), such as tricking a user into executing a specific action. Successful exploitation allows elevation to higher privileges, granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).
The Acronis security advisory SEC-6418 at https://security-advisory.acronis.com/advisories/SEC-6418 provides details on mitigation, including patching to build 39169 or later for affected Acronis Cyber Protect 16 installations on Windows.
Details
- CWE(s)