CVE-2021-27878
Veritas Backup Exec Agent Command Execution Vulnerability
Description
CVE-2021-27878 is an authentication bypass and remote command execution vulnerability in Veritas Backup Exec before version 21.2. Similar to related vulnerabilities CVE-2021-27876 and CVE-2021-27877, this flaw resides in the SHA Authentication scheme used for client-to-Agent communication, allowing attackers to bypass authentication and gain unauthorized access. Once authenticated, the attacker can execute arbitrary commands on the system with System-level privileges through crafted data management protocol commands. This Veritas Backup Exec vulnerability has been confirmed by CISA as actively exploited in ransomware campaigns, and with a CVSS score of 8.8 (High), it represents the most severe of the three related Backup Exec vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veritas | backup exec | < 21.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27878(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2021-27878 by NVD. The vulnerability combines an authentication bypass in the SHA Authentication scheme with the ability to execute arbitrary operating system commands through the Backup Exec Agent's data management protocol. This allows an attacker to escalate from unauthorized network access to full System-level command execution on the target host.
Impact Analysis
CVE-2021-27878 carries the highest CVSS score among the related Veritas Backup Exec vulnerabilities at 8.8 (High), reflecting its complete impact across all three CIA triad dimensions. The vulnerability is remotely exploitable over the network with low attack complexity, requiring only low-level privileges and no user interaction. Confidentiality (High): Successful exploitation grants the attacker System-level access, enabling exfiltration of any data accessible to the Backup Exec Agent, including backup archives, credentials, and sensitive configuration data. Integrity (High): The ability to execute arbitrary commands means attackers can modify system configurations, tamper with backup data, and deploy additional malicious payloads. Availability (High): Command execution with System privileges allows attackers to disrupt backup operations, delete data, or render systems inoperable. The confirmed association with ransomware campaigns makes this particularly dangerous, as attackers use this vulnerability to deploy ransomware that encrypts both production and backup data simultaneously.
Exploit Maturity
Public exploit code is available for CVE-2021-27878 via Packet Storm Security, which provides a complete remote code execution proof-of-concept targeting Veritas Backup Exec Agents. CISA has confirmed active exploitation in the wild, and this vulnerability is known to be used in ransomware operations. The EPSS score of 6.9% (91st percentile) indicates a high probability of exploitation relative to the broader vulnerability landscape. CVE-2021-27878 is typically chained with CVE-2021-27877 (authentication bypass via deprecated SHA scheme) and CVE-2021-27876 (arbitrary file access), forming a complete attack chain from initial access to full system compromise in Veritas Backup Exec environments.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The CISA remediation deadline was April 28, 2023.
- Upgrade Veritas Backup Exec to version 21.2 or later, which addresses the SHA Authentication scheme vulnerability and the command execution flaw. Refer to the Veritas security advisory VTS21-001 for upgrade instructions.
- Isolate Backup Exec infrastructure by placing Agents and backup servers in a dedicated network segment with strict firewall rules. Only allow communication from authorized backup management servers, and block all inbound connections from user networks and the internet.
- Monitor for signs of exploitation by reviewing Backup Exec Agent logs for unauthorized authentication attempts, unusual command execution, and connections from unknown IP addresses. Deploy host-based intrusion detection to alert on unexpected process creation by the Backup Exec Agent service.
- Conduct a post-compromise assessment if your environment was running a vulnerable version. Check for unauthorized access, verify backup integrity, and scan for ransomware indicators. Ensure backup data has not been tampered with or encrypted by threat actors.
Technical Details
CVE-2021-27878 exploits the same SHA Authentication scheme vulnerability present in CVE-2021-27876 and CVE-2021-27877 within Veritas Backup Exec. The authentication bypass allows an attacker to establish an authenticated session with a Backup Exec Agent over the network without valid credentials. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows network-based exploitation with low complexity, low privilege requirements, and no user interaction needed, with high impact across all three security dimensions. What distinguishes CVE-2021-27878 from its siblings is the specific data management protocol command that is abused: while CVE-2021-27876 enables arbitrary file access, CVE-2021-27878 allows the execution of arbitrary operating system commands with System privileges. The attacker crafts specific input parameters within the data management protocol to inject and execute commands, effectively achieving remote code execution on the target host through the Backup Exec Agent service.
Frequently Asked Questions
Is CVE-2021-27878 being actively exploited?
Yes, CVE-2021-27878 is actively exploited in the wild. CISA has confirmed its exploitation and listed it in the Known Exploited Vulnerabilities catalog, with documented use in ransomware campaigns. Public exploit code is readily available, making exploitation accessible to a wide range of threat actors.
What products are affected by CVE-2021-27878?
CVE-2021-27878 affects Veritas Backup Exec Agent in all versions prior to 21.2. Any organization running an unpatched Backup Exec deployment is vulnerable to this remote command execution flaw through the deprecated SHA Authentication scheme.
How do I fix CVE-2021-27878?
Upgrade Veritas Backup Exec to version 21.2 or later to address the vulnerability. As an interim measure, isolate Backup Exec Agents in a dedicated network segment and restrict access to authorized backup servers only. Review the Remediation section for comprehensive steps.
How severe is CVE-2021-27878?
CVE-2021-27878 is rated High severity with a CVSS v3.1 score of 8.8, the highest among the three related Veritas Backup Exec vulnerabilities. Its EPSS score places it in the 91st percentile for exploitation probability, and the confirmed use in ransomware campaigns makes immediate remediation essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.