{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aacroniscyber_protect_home_officewindows/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:acronis:cyber_protect:15:*:*:*:*:*:*:*","cpe:2.3:a:acronis:agent:*:*:*:*:*:windows:*:*","cpe:2.3:a:acronis:cyber_protect:15:*:*:*:*:windows:*:*","cpe:2.3:a:acronis:cyber_protect_home_office:*:*:*:*:*:windows:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2022-45451"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Acronis Agent (\u003c 22.10)","Acronis Cyber Protect (= 15)","Acronis Cyber Protect Home Office (\u003c 40173)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","arbitrary-file-read","driver-vulnerability","windows"],"_cs_type":"advisory","_cs_vendors":["Acronis"],"content_html":"\u003cp\u003eCVE-2022-45451 is a vulnerability affecting the \u003ccode\u003engscan.sys\u003c/code\u003e minifilter driver included in multiple Acronis Cyber Protect products. The vulnerability stems from improper access control on the driver's filter communication ports. Specifically, the driver initializes communication ports with a default or NULL Discretionary Access Control List (DACL), which permits local, low-privileged processes to communicate with the driver.\u003c/p\u003e\n\u003cp\u003eAn attacker can leverage this communication channel to request the creation of a \u0026quot;scan context\u0026quot; for any file on the system. Once the context is established, the driver returns a file descriptor for the requested resource, bypassing standard filesystem access restrictions. This enables arbitrary file reads, including sensitive system files like the Windows Security Account Manager (SAM) database. Furthermore, the driver exposes functions to manipulate specific registry keys, which researchers identified as a potential vector for achieving local code execution by targeting DLL injection mechanisms.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial local access to a Windows system running a vulnerable version of Acronis Cyber Protect.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the \u003ccode\u003engscan.sys\u003c/code\u003e driver's communication ports, which are created with improper DACLs (including NULL).\u003c/li\u003e\n\u003cli\u003eThe attacker opens a communication handle to the driver by sending a specially crafted message header (\u0026quot;TrMs\u0026quot;) to the identified filter communication port.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a request to the driver to create a \u0026quot;scan context\u0026quot; for a target system file, such as \u003ccode\u003eC:\\Windows\\System32\\config\\SAM\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe driver creates the context and returns an identification handle to the attacker's process.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the returned handle to open a file descriptor with read access to the restricted system file.\u003c/li\u003e\n\u003cli\u003eThe attacker reads the contents of the target file, facilitating credential theft or further privilege escalation.\u003c/li\u003e\n\u003cli\u003eOptionally, the attacker interacts with the driver's registry manipulation functions to attempt DLL hijacking or injection to elevate privileges to SYSTEM.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local, low-privileged user to read arbitrary files, including password hashes stored in the SAM database, which can be cracked offline to gain elevated credentials. Additionally, the potential for registry manipulation provides a direct path to full system compromise through code execution. The vulnerability affects a wide range of Acronis home and enterprise products.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected systems to versions beyond the vulnerable range immediately (Acronis Agent \u0026gt;= 22.10, Acronis Cyber Protect Home Office \u0026gt;= 40173).\u003c/li\u003e\n\u003cli\u003eMonitor for processes attempting to access sensitive registry keys or system configuration files (e.g., SAM, SYSTEM) that are typically only accessed by the SYSTEM account or specific administrative processes.\u003c/li\u003e\n\u003cli\u003eAudit process handles for \u003ccode\u003engscan.sys\u003c/code\u003e communication ports if logging via kernel-level event tracing is available.\u003c/li\u003e\n\u003cli\u003eDisable or restrict non-administrative access to the \u003ccode\u003engscan.sys\u003c/code\u003e filter communication ports if patching is delayed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T11:14:14Z","date_published":"2026-10-12T11:14:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-acronis-ngscan-arbitrary-file-read/","summary":"A local privilege escalation vulnerability (CVE-2022-45451) in the Acronis ngscan.sys minifilter driver allows low-privileged attackers to perform arbitrary file reads and interact with sensitive registry keys.","title":"CVE-2022-45451: Local Arbitrary File Read and Potential LPE in Acronis ngscan.sys","url":"https://feed.craftedsignal.io/briefs/2026-10-acronis-ngscan-arbitrary-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:acronis:cyber_protect_home_office:*:*:*:*:*:windows:*:*","version":"https://jsonfeed.org/version/1.1"}