CVE-2021-27877: Veritas Backup Exec Auth Bypass Flaw

CVE-2021-27877 Overview

CVE-2021-27877 is an authentication bypass vulnerability affecting Veritas Backup Exec before version 21.2. The vulnerability stems from a deprecated SHA authentication scheme that was no longer in active use but remained enabled in the product. Attackers can remotely exploit this legacy authentication mechanism to gain unauthorized access to Backup Exec Agents and execute privileged commands, potentially compromising backup infrastructure and sensitive data.

Critical Impact
This vulnerability allows unauthenticated remote attackers to bypass authentication controls and execute privileged commands on affected Veritas Backup Exec Agents. The vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Affected Products

Veritas Backup Exec versions prior to 21.2
Veritas Backup Exec Agent components

Discovery Timeline

2021-03-01 - CVE-2021-27877 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-27877

Vulnerability Analysis

This authentication bypass vulnerability exists in Veritas Backup Exec's support for multiple authentication schemes. The SHA authentication scheme, while deprecated and no longer actively used in current product versions, was never properly disabled. This oversight creates a critical security gap where attackers can leverage the legacy authentication mechanism to bypass modern security controls.

The vulnerability enables remote attackers to authenticate using the deprecated SHA scheme without proper credentials, subsequently gaining access to Backup Exec Agent functionality. Once authenticated through this deprecated mechanism, attackers can execute privileged commands on the affected system, potentially leading to complete system compromise.

Root Cause

The root cause of this vulnerability is the failure to disable a deprecated authentication mechanism. When Veritas transitioned to newer authentication methods, the legacy SHA authentication scheme was left enabled in the codebase despite being no longer recommended or actively maintained. This represents a common security anti-pattern where backward compatibility considerations leave deprecated functionality exposed to exploitation.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to a vulnerable Veritas Backup Exec Agent can remotely exploit the deprecated SHA authentication scheme. The attack does not require any prior credentials or privileges, making it particularly dangerous in environments where Backup Exec Agents are accessible from untrusted networks.

The exploitation flow involves targeting the Backup Exec Agent service, authenticating using the deprecated SHA mechanism, and then leveraging the established session to execute privileged commands. Technical details of the exploitation methodology are documented in the Packet Storm exploit analysis.

Detection Methods for CVE-2021-27877

Indicators of Compromise

Unexpected authentication attempts or successful sessions using SHA authentication schemes on Backup Exec Agents
Unusual command execution patterns or privileged operations originating from Backup Exec Agent processes
Network connections to Backup Exec Agent ports (typically TCP 10000) from unauthorized or suspicious IP addresses
Log entries indicating authentication via deprecated authentication mechanisms

Detection Strategies

Monitor Veritas Backup Exec Agent logs for authentication attempts using SHA authentication schemes
Implement network intrusion detection rules to identify exploitation attempts targeting Backup Exec services
Deploy endpoint detection solutions capable of identifying anomalous behavior in Backup Exec Agent processes
Review authentication logs for successful connections that bypass expected authentication workflows

Monitoring Recommendations

Enable detailed logging for all Backup Exec Agent authentication events
Implement network segmentation monitoring to detect lateral movement from compromised backup infrastructure
Configure SIEM alerts for known indicators associated with CVE-2021-27877 exploitation
Monitor for unexpected child processes spawned by Backup Exec Agent services

How to Mitigate CVE-2021-27877

Immediate Actions Required

Upgrade Veritas Backup Exec to version 21.2 or later immediately
Restrict network access to Backup Exec Agents to authorized management systems only
Audit systems for signs of compromise, as this vulnerability is actively exploited
Review and validate all backup infrastructure accounts and permissions

Patch Information

Veritas has addressed this vulnerability in Backup Exec version 21.2 and later releases. Organizations should apply the security update as documented in the Veritas Security Advisory VTS21-001. Given the active exploitation of this vulnerability as noted in the CISA Known Exploited Vulnerabilities Catalog, patching should be prioritized as an emergency remediation activity.

Workarounds

Implement strict network segmentation to isolate Backup Exec Agents from untrusted networks
Configure firewall rules to restrict Backup Exec Agent port access to authorized management servers only
Deploy web application firewalls or network security appliances capable of filtering malicious authentication attempts
Consider temporarily disabling network-accessible Backup Exec Agents until patches can be applied

bash

# Example: Restrict Backup Exec Agent access via firewall (adjust ports and IPs as needed)
# Allow only authorized management servers to access Backup Exec Agent
iptables -A INPUT -p tcp --dport 10000 -s <authorized_management_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 10000 -j DROP