CVE-2023-48677

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938, Acronis True Image OEM (Windows) before build 42575.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Acronis	Acronis Cyber Protect Home Office	>= unspecified, < 40901
Acronis	Acronis Cyber Protect Cloud Agent	>= unspecified, < 39378
Acronis	Acronis Cyber Protect 16	>= unspecified, < 39938
Acronis	Acronis True Image OEM	>= unspecified, < 42575

References

https://security-advisory.acronis.com/advisories/SEC-5620Vendor Advisory
https://security-advisory.acronis.com/advisories/SEC-5620Vendor Advisory

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-486785.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, W CVE-2023-486795.4Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acroni CVE-2023-48688.8A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is CVE-2023-486805.5Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Prote CVE-2023-486816.1Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (CVE-2023-486825.4Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)CVE-2023-486837.1Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect C CVE-2023-486847.1Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect C CVE-2023-486859.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.ph CVE-2023-486879.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reserva CVE-2023-486899.8Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train CVE-2023-48698.8A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknow