<\/div>\n

Veeam addressed 18 high and critical severity flaws in\u00a0Veeam Backup & Replication,\u00a0Service Provider Console, and One.<\/h2>\n\n\n\n

Veeam security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in\u00a0Veeam Backup & Replication,\u00a0Service Provider Console, and One.<\/p>\n\n\n\n

The most severe flaw included in the September 2024\u00a0security bulletin is\u00a0a critical, remote code execution (RCE) vulnerability tracked as CVE-2024-40711 (CVSS v3.1 score: 9.8) impacting Veeam Backup & Replication (VBR). <\/p>\n\n\n\n

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. It enables organizations to back up, restore, and replicate data across physical, virtual, and cloud environments.<\/gwmw><\/p>\n\n\n\n

“A vulnerability allowing unauthenticated remote code execution (RCE).” reads the advisory<\/a>.<\/em><\/p>\n\n\n\n

Florian Hauser, cybersecurity researcher at CODE WHITE Gmbh, reported this vulnerability.<\/p>\n\n\n\n

The flaw impacts Veeam Backup & Replication 12.1.2.172\u00a0and all\u00a0earlier version 12 builds<\/a>.\u00a0<\/p>\n\n\n\n

The company also addressed a vulnerability, tracked as CVE-2024-40713 (CVSS v3.1 score: 8.8) that allows a user who has been assigned\u00a0a low-privileged role within Veeam Backup & Replication<\/a>\u00a0to alter Multi-Factor Authentication (MFA) settings and bypass MFA.<\/p>\n\n\n\n

The company also fixes a series of related high-severity vulnerabilities tracked as CVE-2024-40710, the most notable one could lead to remote code execution (RCE) as the service account and extraction of sensitive information (saved credentials and passwords). The exploitation of these vulnerabilities requires a user who has been assigned\u00a0a low-privileged role within Veeam Backup & Replication<\/a>.<\/gwmw><\/p>\n\n\n\n

The other issues included in the bulletin are impacting Backup & Replication versions 12.1.2.172 and older are:<\/p>\n\n\n\n

\n
• CVE-2024-40712<\/strong>: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to\u202fperform local privilege escalation (LPE). (CVSS score: 7.8)<\/li>\n\n\n\n
• CVE-2024-40714<\/strong>: A vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. (CVSS score: 8.3)<\/li>\n\n\n\n
• CVE-2024-39718<\/strong>: \u202fA vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. (CVSS score: 8.1)<\/gwmw><\/li>\n<\/ul>\n\n\n\n

  The remaining issues covered by the bulletin impact Service Provider Console, and One software. <\/p>\n\n\n\n

  The company did not disclose whether any of the issues in the bulletin had been exploited in attacks in the wild.<\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0Veeam Backup & Replication<\/a>)<\/strong><\/p>\n\n\n\n

  <\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  Veeam addressed 18 high and critical severity flaws in\u00a0Veeam Backup & Replication,\u00a0Service Provider Console, and One. Veeam security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in\u00a0Veeam Backup & Replication,\u00a0Service Provider Console, and One. The most severe flaw included in the September 2024\u00a0security bulletin is\u00a0a critical, […]<\/p>\n","protected":false},"author":1,"featured_media":129098,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,55],"tags":[15351,4112,9508,10918,687,841,1533,4333,15220],"class_list":["post-168088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-security","tag-cve-2024-40711","tag-hacking","tag-hacking-news","tag-it-information-security","tag-pierluigi-paganini","tag-security-affairs","tag-security-news","tag-veeam","tag-veeam-backup-replication"],"yoast_head":"\n