Fixed vulnerabilities in several Veeam products.

🗓️ 11 Oct 2024 09:18:53Reported by NCSCType

ncsc

ncsc🔗 advisories.ncsc.nl👁 5 Views

Veeam fixed vulnerabilities in several products; CVE-2024-40711 enables unauthenticated code execution.

Reporter	Title	Published	Views	Family All 200
ATTACKERKB	CVE-2024-40711	7 Sep 202400:00	–	attackerkb
Information Security Automation	Veeam B&R RCE vulnerability CVE-2024-40711 is exploited in attacks	13 Oct 202409:41	–	avleonov
Information Security Automation	September episode of “In The Trend of VM”: 7 CVEs, fake reCAPTCHA, lebanese pagers, VM and IT annual bonuses	21 Oct 202413:01	–	avleonov
BDU FSTEC	The vulnerability of Veeam Backup & Replication’s protection mechanisms for cloud, virtual, and physical systems stems from errors in privilege management, allowing attackers to execute arbitrary code.	6 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the file loading function of the backup and recovery software for remote and cloud-based Veeam Service Provider Console (VSPC) customers allows a hacker to execute arbitrary code on the VSPC server.	9 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Veeam ONE monitoring software, related to deficiencies in access control, allows a perpetrator to execute arbitrary code on systems where the Veeam ONE Agent is installed.	9 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Reporter Widget component in the Veeam ONE monitoring software allows a attacker to execute arbitrary HTML code.	20 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Veeam ONE monitoring software, related to inadequate access control, allows a hacker to bypass existing security restrictions and gain unauthorized access to protected information.	20 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the application software interface of the backup and recovery software for Veeam Service Provider Console (VSPC) for remote and cloud customers allows a perpetrator to execute arbitrary code.	20 Sep 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the NTLM protocol implementation in the backup and recovery software for remote and cloud-based Veeam Service Provider Console (VSPC) users allows a hacker to bypass authentication procedures and gain unauthorized access to protected information.	20 Sep 202400:00	–	bdu_fstec

Vulners

Node

veeam oneMatch11

OR

veeam oneMatch12

OR

veeam veeam_service_provider_consoleMatch8

Source	Link
veeam	www.veeam.com/kb4649
infosec	www.infosec.exchange/@SophosXOps/113284564225476186
bleepingcomputer	www.bleepingcomputer.com/news/security/akira-and-fog-ransomware-now-exploiting-critical-veeam-rce-flaw/

11 Oct 2024 09:18Current

8High risk

Vulners AI Score8

CVSS 39.9

CVSS 3.19.8

EPSS0.88193

SSVC

Veeam vulnerabilities Backup and replication Veeam ONE Service Provider Console Veeam Agent CVE 2024 40711 Ransomware risk