CVE-2021-27878

8.8

CVSS
High

PUBLISHED

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication,...

Exploited in the wild Used in malware Remote Low complexity No user interaction

Vendor: Veritas
Product: Backup Exec
Published: Mar 01, 2021
EPSS: —

Description

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

cisa malware ransomware metasploit

CVSS scores

CVSS v3.1 8.8 High

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Exploitation status

Exploited in the wild

Recorded 2023-04-07 00:00:00 UTC · Source

Used in malware

Recorded 2023-04-07 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Apr 07, 2023

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb	Apr 28, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

beagent_sha_auth_rce

metasploit · Created Unknown

Metasploit module for CVE-2021-27878

Vulnerability detail