Veeam patches critical remote code execution vulnerabilities in multiple products

The latest Veeam patches address multiple critical vulnerabilities across its products, including unauthenticated remote code execution flaws with severity scores up to 9.9. These updates are crucial for mitigating risks associated with data backup and cloud management systems.

By Khushi Jain Published on September 6, 2024, 10:24 EDT

Image Credits - scmagazine

Veeam, a prominent player in data backup and cloud data management, has released critical patches addressing a series of severe vulnerabilities across its product range. According to a security advisory issued earlier this week, the company has remedied 18 flaws in total, five of which are classified as critical due to their potential for remote code execution (RCE).

The most critical vulnerability, tracked as CVE-2024-40711, is an unauthenticated RCE issue in Veeam Backup & Replication. This flaw has been assigned a severity score of 9.8, indicating its high risk. Another set of vulnerabilities affects Veeam ONE. CVE-2024-42024, which also has a severe rating of 9.1, allows attackers who possess Agent service account credentials to execute remote code. Additionally, CVE-2024-42019, with a score of 9.0, permits attackers to access the NTLM hash of the Veeam Reporter Service account.

Another critical flaw, CVE-2024-38650, discovered in Veeam Service Provider Console, has a severity score of 9.9. This bug allows attackers with low privileges to access the NTLM hash of the service account on the server. Similarly, CVE-2024-39714, also rated 9.9, enables low-privileged users to upload arbitrary files.

In addition to these critical issues, Veeam has addressed 13 other vulnerabilities of high severity. These include flaws that could lead to multi-factor authentication (MFA) bypass, privilege escalation, and additional instances of remote code execution.