CVE-2020-10138: 
Acronis Cyber Backup vulnerability analysis and mitigation

Acronis Cyber Backup 12.5 and Cyber Protect 15 contain a privilege escalation vulnerability (CVE-2020-10138) with a CVSS score of 8.1. The vulnerability was discovered in October 2020 and affects the OpenSSL component of these backup software products (CERT VU, SecurityWeek).

The vulnerability exists in a privileged service that uses an OpenSSL component which specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent. Due to the way Windows handles permissions, unprivileged users can create subdirectories off of the system root, allowing them to create the appropriate path to a specially-crafted openssl.cnf file (CERT VU).

When successfully exploited, this vulnerability allows an unprivileged Windows user to execute arbitrary code with SYSTEM privileges on systems with the vulnerable Acronis software installed (SecurityWeek, CERT VU).

The vulnerability can be exploited by placing a specially-crafted openssl.cnf file in a specific location, allowing an unprivileged user to achieve arbitrary code execution with SYSTEM privileges (CERT VU).

The vulnerability has been patched in Acronis Cyber Backup 12.5 build 16363 and Acronis Cyber Protect 15 build 24600. Users are advised to update to these versions to mitigate the vulnerability (CERT VU, SecurityWeek).