Veeam fixed a critical flaw in Veeam Backup & Replication software

Veeam addressed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.

Veeam security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.

The most severe flaw included in the September 2024 security bulletin is a critical, remote code execution (RCE) vulnerability tracked as CVE-2024-40711 (CVSS v3.1 score: 9.8) impacting Veeam Backup & Replication (VBR).

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. It enables organizations to back up, restore, and replicate data across physical, virtual, and cloud environments.

“A vulnerability allowing unauthenticated remote code execution (RCE).” reads the advisory.

Florian Hauser, cybersecurity researcher at CODE WHITE Gmbh, reported this vulnerability.

The flaw impacts Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds. 

The company also addressed a vulnerability, tracked as CVE-2024-40713 (CVSS v3.1 score: 8.8) that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.

The company also fixes a series of related high-severity vulnerabilities tracked as CVE-2024-40710, the most notable one could lead to remote code execution (RCE) as the service account and extraction of sensitive information (saved credentials and passwords). The exploitation of these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.

The other issues included in the bulletin are impacting Backup & Replication versions 12.1.2.172 and older are:

• CVE-2024-40712: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). (CVSS score: 7.8)
• CVE-2024-40714: A vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. (CVSS score: 8.3)
• CVE-2024-39718:  A vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. (CVSS score: 8.1)

The remaining issues covered by the bulletin impact Service Provider Console, and One software.

The company did not disclose whether any of the issues in the bulletin had been exploited in attacks in the wild.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Veeam Backup & Replication)