CVE-2021-27877
Veritas Backup Exec Agent Improper Authentication Vulnerability
Description
CVE-2021-27877 is an authentication bypass vulnerability in Veritas Backup Exec before version 21.2 that allows remote unauthorized access to Backup Exec Agents. The flaw exists because the SHA Authentication scheme, which is no longer actively used in current product versions, was never properly disabled, leaving a legacy attack surface exposed. An attacker can remotely exploit this deprecated authentication scheme to gain unauthorized access and execute privileged commands on the Agent without any authentication. CISA has confirmed active exploitation of this Veritas Backup Exec vulnerability in the wild, with known use in ransomware campaigns, and the EPSS score of 29.4% (96th percentile) indicates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veritas | backup exec | < 21.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27877(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2021-27877 by NVD. The core weakness in this Veritas Backup Exec vulnerability is the presence of a deprecated but still-enabled authentication scheme (SHA Authentication) that can be exploited to bypass security controls. This represents a failure to properly decommission legacy authentication mechanisms, allowing attackers to leverage an outdated protocol to gain unauthorized access.
Impact Analysis
CVE-2021-27877 is rated High severity with a CVSS v3.1 score of 8.2, reflecting its significant risk profile. The vulnerability is remotely exploitable over the network with low attack complexity and, critically, requires no authentication and no user interaction to exploit. This combination makes automated, large-scale exploitation straightforward. Confidentiality (High): An attacker who exploits this vulnerability gains unauthorized access to the Backup Exec Agent, potentially exposing all backup data, credentials, and sensitive configuration information managed by the Agent. Integrity (Low): The attacker can execute privileged commands, which could allow limited modification of Agent settings or data. The confirmed association with ransomware campaigns significantly elevates the real-world impact, as threat actors actively chain this vulnerability with related Backup Exec flaws to achieve full system compromise and deploy ransomware payloads.
Exploit Maturity
Public exploit code is available for CVE-2021-27877 via Packet Storm Security, providing a complete proof-of-concept for remote code execution against Veritas Backup Exec Agents. CISA has confirmed active exploitation in the wild, and this vulnerability is known to be leveraged in ransomware operations. The EPSS score of 29.4% (96th percentile) indicates a very high probability of exploitation, placing it among the most likely-to-be-exploited vulnerabilities tracked. This CVE is commonly chained with CVE-2021-27876 (arbitrary file access) and CVE-2021-27878 (arbitrary command execution) to achieve a complete compromise of Veritas Backup Exec environments.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The CISA remediation deadline was April 28, 2023.
- Upgrade Veritas Backup Exec to version 21.2 or later, which properly disables the vulnerable SHA Authentication scheme. Consult the Veritas security advisory VTS21-001 for specific upgrade guidance.
- Restrict network access to Backup Exec Agent ports using firewall rules and network segmentation. Ensure that only trusted backup server IP addresses can reach Agent communication ports, and block all external access.
- Audit Agent logs for unauthorized access by reviewing authentication attempts and command execution logs. Look for connections using the SHA Authentication scheme and any privileged command execution from unexpected sources.
- Implement a decommissioning process for legacy protocols across your backup infrastructure. Review all Backup Exec Agent configurations to ensure deprecated authentication methods are explicitly disabled rather than left dormant.
Technical Details
CVE-2021-27877 exploits a fundamental security oversight in Veritas Backup Exec: the SHA Authentication scheme, while no longer actively used in current product versions, was never properly disabled in the Agent service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reveals that the vulnerability requires no privileges and no user interaction to exploit over the network, with low attack complexity. An attacker can remotely connect to a Backup Exec Agent and initiate authentication using the legacy SHA scheme, which the Agent still accepts despite the protocol being deprecated. Upon successful exploitation of this authentication bypass, the attacker gains the ability to execute privileged commands on the Agent, with high impact on confidentiality due to access to backup data and low impact on integrity through command execution capabilities. The scope is unchanged, meaning exploitation is contained to the Backup Exec Agent component itself.
Frequently Asked Questions
Is CVE-2021-27877 being actively exploited?
Yes, CVE-2021-27877 is actively exploited in the wild. CISA has listed it in the Known Exploited Vulnerabilities catalog with confirmed use in ransomware campaigns. The EPSS score of 29.4% (96th percentile) further confirms a very high likelihood of exploitation.
What products are affected by CVE-2021-27877?
CVE-2021-27877 affects Veritas Backup Exec Agent in all versions prior to 21.2. Any Backup Exec deployment that has not been updated to version 21.2 or later is vulnerable, as the deprecated SHA Authentication scheme remains enabled by default in older versions.
How do I fix CVE-2021-27877?
Upgrade Veritas Backup Exec to version 21.2 or later, which properly disables the legacy SHA Authentication scheme. As an interim measure, restrict network access to Backup Exec Agent ports to authorized backup servers only. See the Remediation section for complete guidance.
How severe is CVE-2021-27877?
CVE-2021-27877 is rated High severity with a CVSS v3.1 score of 8.2. Its EPSS score places it in the 96th percentile for exploitation probability, and the confirmed use in ransomware campaigns makes it one of the most urgent Veritas Backup Exec vulnerabilities to address.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.