CVE-2024-34010

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True Image (Windows) before build 42386, Acronis True Image OEM (Windows) before build 42575.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

VendorProductVersions
AcronisAcronis Cyber Protect Cloud Agent>= unspecified, < 37758
AcronisAcronis Cyber Protect 16>= unspecified, < 38690
AcronisAcronis True Image>= unspecified, < 42386
AcronisAcronis True Image OEM>= unspecified, < 42575
acroniscyber_protect_cloud_agent>= -, < build_37758

References

Timeline

Published
Apr 29, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-340116.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoCVE-2024-340124.4Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bCVE-2024-340137.8Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) beforeCVE-2024-340145.5Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin CVE-2024-340153.3Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis BCVE-2024-340166.5Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoCVE-2024-340177.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before buiCVE-2024-340185.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) befoCVE-2024-340197.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before buiCVE-2024-34025.4A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitizationCVE-2024-340206.5A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1.CVE-2024-340216.8Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploade