Veeam warns of critical RCE flaw in Backup & Replication software
Veeam has released security updates for several of its products as part of a single September 2024 security bulletin that addresses 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.
The most severe of the problems addressed is CVE-2024-40711, a critical (CVSS v3.1 score: 9.8) remote code execution (RCE) vulnerability on Veeam Backup & Replication (VBR) that can be exploited without authentication.
VBR is used to manage and secure backup infrastructure for enterprises, so it plays a critical role in data protection. As it can serve as a pivot point for lateral movement, it is considered a high-value target for ransomware operators.
Ransomware actors target the service to steal backups for double-extortion and delete/encrypt backup sets, so victims are left without recovery options.
In the past, the Cuba ransomware gang and FIN7, known to collaborate with Conti, REvil, Maze, Egregor, and BlackBasta, were observed targeting VBR vulnerabilities.
The flaw, which was reported via HackerOne, impacts Veeam Backup & Replication 12.1.2.172 and all earlier versions of the 12 branch.
Although not many details have been disclosed at this time, critical RCE flaws generally allow for a complete system takeover, so users shouldn't postpone installing the fixes in VBR version 12.2.0.334.
The other flaws listed in the bulletin are related to Backup & Replication versions 12.1.2.172 and older are:
- CVE-2024-40710: Series of vulnerabilities enabling remote code execution (RCE) and sensitive data extraction (saved credentials and passwords) by a low-privileged user. (CVSS score: 8.8 "high")
- CVE-2024-40713: Low-privileged users can alter Multi-Factor Authentication (MFA) settings and bypass MFA. (CVSS score: 8.8 "high")
- CVE-2024-40714: Weak TLS certificate validation allows credential interception during restore operations on the same network. (CVSS score: 8.3 "high")
- CVE-2024-39718: Low-privileged users can remotely remove files with permissions equivalent to the service account. (CVSS score: 8.1 "high")
- CVE-2024-40712: Path traversal vulnerability allows a local low-privileged user to perform local privilege escalation (LPE). (CVSS score: 7.8 "high")
More critical flaws in Veeam products
On the same bulletin, Veeam lists four more critical-severity vulnerabilities impacting its Service Provider Console versions 8.1.0.21377 and earlier and ONE products versions 12.1.0.3208 and older.
Starting with CVE-2024-42024 (CVSS score 9.1), an attacker with ONE Agent service account credentials can perform remote code execution on the host machine.
Veeam ONE is also impacted by CVE-2024-42019 (CVSS score 9.0), which allows an attacker to access the NTLM hash of the Reporter Service account. Exploiting this flaw requires previous data collection through VBR.
In Veeam Service Provider Console, there's CVE-2024-38650 (CVSS score 9.9) which allows a low-privileged attacker to access the NTLM hash of the service account on the VSPC server.
The second critical problem is tracked as CVE-2024-39714 (CVSS score 9.9) and enables a low-privileged user to upload arbitrary files onto the server, leading to remote code execution.
All issues were fixed in Veeam ONE version 12.2.0.4093 and Veeam Service Provider Console version 8.1.0.21377, which users should upgrade to as soon as possible.
U.S. Seizes 32 Pro-Russian Propaganda Domains in Major Disinformation Crackdown
Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords
CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection Vulnerability
CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability
CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
InformationalPossible Username Enumeration
InformationalAuthentication Request Identified
LowInformation Disclosure - Sensitive Information in Browser sessionStorage
HighPath Traversal
MediumCSP: Wildcard Directive
InformationalInformation Disclosure - JWT in Browser sessionStorage
InformationalSec-Fetch-User Header Has an Invalid Value
Free online web security scanner