CVE-2024-49387: Acronis Cyber Protect Info Disclosure Flaw

CVE-2024-49387 Overview

CVE-2024-49387 affects the acep-collector service in Acronis Cyber Protect 16 on Linux and Windows. The service transmits sensitive information in cleartext, allowing network attackers to intercept data in transit [CWE-319]. Acronis addressed the issue in build 38690. The vulnerability requires no authentication or user interaction and can be exploited over the network. Confidentiality impact is high, while integrity and availability are not affected.

Critical Impact
Network-positioned attackers can intercept sensitive data transmitted by the acep-collector service without authentication or user interaction.

Affected Products

Acronis Cyber Protect 16 for Linux (before build 38690)
Acronis Cyber Protect 16 for Windows (before build 38690)
Acronis Cyber Protect 16 Update 1

Discovery Timeline

2024-10-15 - CVE-2024-49387 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49387

Vulnerability Analysis

The acep-collector service in Acronis Cyber Protect 16 transmits sensitive information across the network without encryption. An attacker with the ability to observe network traffic between the collector and its endpoints can read the data in clear form. The flaw maps to [CWE-319] Cleartext Transmission of Sensitive Information. Because the issue is in transport-layer protection rather than authentication or input handling, exploitation does not require any credentials or interaction from a user. The Exploit Prediction Scoring System probability remains low based on current data, but the exposure persists wherever the collector traffic crosses untrusted segments.

Root Cause

The acep-collector service did not enforce encrypted transport for sensitive payloads. Data that should have been transmitted over a protected channel such as TLS was instead sent in cleartext. This design omission exposes the collector channel to passive interception by anyone with visibility into the network path.

Attack Vector

An attacker requires a network position between the acep-collector client and server to intercept traffic. Common scenarios include shared broadcast segments, compromised network devices, rogue wireless access points, and on-path attacks against routing. Once positioned, the attacker captures packets and reads the cleartext payload without further interaction. See the Acronis Security Advisory SEC-7022 for additional technical detail.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose because Acronis has not published exploitation details.

Detection Methods for CVE-2024-49387

Indicators of Compromise

Unencrypted TCP sessions originating from or destined to the acep-collector service ports on Acronis Cyber Protect 16 hosts.
Captured network traffic containing recognizable Acronis collector payload strings in cleartext.
Acronis Cyber Protect 16 hosts running builds earlier than 38690.

Detection Strategies

Inventory all Acronis Cyber Protect 16 installations and identify hosts running builds prior to 38690.
Use network sensors to flag plaintext traffic associated with the acep-collector service across enterprise segments.
Correlate process telemetry from acep-collector with outbound network connections to identify exposed channels.

Monitoring Recommendations

Monitor Acronis Cyber Protect server and agent communications for non-TLS sessions on collector ports.
Alert on new Acronis Cyber Protect 16 deployments that do not match the patched build baseline.
Track network captures or packet broker outputs for clear-text fields associated with the collector protocol.

How to Mitigate CVE-2024-49387

Immediate Actions Required

Upgrade Acronis Cyber Protect 16 to build 38690 or later on all Linux and Windows hosts.
Restrict acep-collector traffic to trusted management VLANs until patching is complete.
Audit network segments that carry Acronis backup and collector traffic for unauthorized listeners.

Patch Information

Acronis released a fix in Acronis Cyber Protect 16 build 38690. Refer to the Acronis Security Advisory SEC-7022 for the official patch notice and download instructions.

Workarounds

Place acep-collector traffic inside an encrypted overlay such as an IPsec tunnel or VPN until the patch is applied.
Limit access to the collector service using host firewall rules that restrict source addresses to known management hosts.
Segment Acronis Cyber Protect components onto a dedicated management network that is not exposed to general user traffic.

bash

# Example host firewall restriction (Linux, iptables)
# Replace <MGMT_CIDR> with your trusted management subnet
iptables -A INPUT -p tcp --dport <ACEP_PORT> -s <MGMT_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <ACEP_PORT> -j DROP