CVE-2024-49383: 
Acronis Cyber Protect vulnerability analysis and mitigation

Excessive attack surface in acep-importer service due to binding to an unrestricted IP address affecting Acronis Cyber Protect 16 (Linux, Windows) before build 38690. The vulnerability was disclosed on October 15, 2024 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is categorized under CWE-1327 (Binding to an Unrestricted IP Address). The issue was initially analyzed by NIST on October 16, 2024 (NVD).

The vulnerability allows potential exposure of the acep-importer service to unauthorized network access, which could lead to information disclosure. The CVSS scoring indicates that while the vulnerability can result in some information disclosure, it does not impact system integrity or availability (NVD).

Users should upgrade to Acronis Cyber Protect 16 build 38690 or later to address this vulnerability. The fix has been implemented in this version to prevent the acep-importer service from binding to unrestricted IP addresses (NVD).