Veritas System Recovery vulnerabilities

5 CVEs affecting Veritas System Recovery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-35204, published 2024-05-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-7444, published 2017-04-05. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Veritas System Recovery before 16 SP1, there is a DLL hijacking vulnerability in the patch installer if an attacker has write access to the directory from which the product is executed.
CVE-2022-41320, published 2022-09-23. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a…
CVE-2020-36160, published 2021-01-06. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf…
CVE-2022-26778, published 2022-03-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This could allow a Windows user (who has…
CVE-2024-35204, published 2024-05-14. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks.