CVE-2023-41743: 
Acronis Cyber Protect Home Office vulnerability analysis and mitigation

CVE-2023-41743 is a local privilege escalation vulnerability discovered in multiple Acronis products due to insecure driver communication port permissions. The affected products include Acronis Cyber Protect Home Office (Windows) versions before build 40278, Acronis Agent (Windows) before build 31637, and Acronis Cyber Protect 15 (Windows) before build 35979. The vulnerability was disclosed on August 31, 2023 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates a local attack vector, low attack complexity, low privileges required, no user interaction needed, and high impact on confidentiality, integrity, and availability. The vulnerability is classified as CWE-269 (Improper Privilege Management) (NVD).

The successful exploitation of this vulnerability could lead to local privilege escalation, potentially allowing an attacker to gain elevated system privileges. The high impact scores across confidentiality, integrity, and availability (C:H/I:H/A:H) indicate that successful exploitation could result in complete compromise of system security (NVD).

The vulnerability requires local access to the system and low privileges for exploitation. The attack complexity is rated as low, suggesting that the vulnerability is relatively straightforward to exploit once the attacker has the necessary local access (NVD).

Users are advised to update to the following fixed versions: Acronis Cyber Protect Home Office (Windows) build 40278 or later, Acronis Agent (Windows) build 31637 or later, and Acronis Cyber Protect 15 (Windows) build 35979 or later (NVD).