CVE-2020-10140

CVE-2020-10140 is a privilege escalation vulnerability in Acronis True Image 2021, stemming from improperly set Access Control Lists (ACLs) on the C:\ProgramData\Acronis directory. This allows an unprivileged local user to achieve arbitrary code execution with SYSTEM privileges by placing a malicious DLL in specific paths within that directory, which is then executed by privileged processes. The vulnerability has a CVSS score of 7.3 (HIGH), indicating a low attack complexity and requiring user interaction for exploitation, with high impacts on confidentiality, integrity, and availability. While there are no public exploit modules or evidence of active exploitation, the vulnerability has garnered some community discussion and media coverage.