Veeam ONE Agent .NET Deserialization Exploit

This Metasploit module exploits a .NET deserialization vulnerability in the Veeam ONE Agent before the hotfix versions 9.5.5.4587 and 10.0.1.750 in the 9 and 10 release lines. Specifically, the module targets the HandshakeResult method used by the Agent. By inducing a failure in the handshake, th...

Veeam ONE Agent .NET Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Veeam ONE Agent .NET Deserialization', 'Description' = %q This module exploits a .NET deserialization vulnerability in the Veeam ONE Agent before...

Veeam Backup for Microsoft Azure Recovery/Migration Procedure

This document explains how to recover or migrate Veeam Backup for Microsoft Azure data to new instance.A Veeam Backup for Microsoft Azure instance may fail or get corrupt and requires the data volume...

How to Reset Password in Veeam Plug-In for Microsoft Azure Appliance

Purpose This article documents methods to reset the password of the Veeam Plug-In for Microsoft Azure service account. Solution Reset Password via The Microsoft Azure portal 1. Open the Microsoft Azure portal. 2. Log in using your Microsoft Azure credentials. 3. Select the virtual machine with...

Configuring Multiple Azure Active Directories

Challenge There are different ways to back up VMs from different tenants/subscriptions in Veeam Backup for Microsoft Azure. Multiple Microsoft Azure accounts may be added to Veeam Backup for Microsoft Azure. To handle VMs belonging to different accounts, add them as Azure accounts in Veeam Backup...

MBR disk restore to UEFI system fails with "OS disk in backup uses MBR disk" warning

Challenge When attempting to restore a Windows machine using Bare Metal Recovery, the restore displays the warning: OS disk in backup uses MBR disk. This may cause boot issues on UEFI systems Cause The Bare Metal Recovery restore has detected that the system within the selected restore point was...

How to Limit Parallel Disk Processing in Veeam Agent for Microsoft Windows

Purpose This article documents how to disable or limit parallel disk processing in Veeam Agent for Microsoft Windows. Solution The following registry values can used to control parallel disk processing on the machine where Veeam Agent for Microsoft Windows is installed: To disable parallel disk...

How to Migrate Veeam Agent Backup Files to Cloud Connect Repository

Purpose This article documents the available methods to migrate backup data from Standalone deployments of Veeam Agent for Microsoft Windows or Veeam Agent for Linux from a non-Cloud Connect Repository to a Cloud Connect repository, allowing the original backup job to continue utilizing that back...

Cannot edit configuration of VMware VM via ESXi after Instant Recovery from Veeam Agent backup

Challenge When you complete Instant VM Recovery from the Veeam Agent backup, then try to edit the VM configuration via ESXi, the following error occurs: "Enter a disk size which is larger than its original capacity." Then you try to edit the decimal virtual disk size via ESXi, and another error...

CVE-2020-10915

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper...

CVE-2020-10915

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper...

CVE-2020-10914

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper...

CVE-2020-10914

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper...

Deserialization of untrusted data

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper...

CVE-2020-10915

CVE-2020-10915 affects VEEAM ONE Agent (version around 9.5.4.4587). The root cause is deserialization of untrusted data in the HandshakeResult method, allowing an unauthenticated attacker to execute code with the service account’s privileges via a network exploit. Public materials reference pre-a...

CVE-2020-10915

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper...

CVE-2020-10914

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper...

CVE-2020-10914

CVE-2020-10914 affects VEEAM One Agent, specifically the component in the PerformHandshake method. The vulnerability arises from insufficient validation of user-supplied data, leading to deserialization of untrusted data and remote code execution in the context of the service account. Reports acr...

CVE-2020-10915 Preauth RCE in VEEAM One Agent

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper...

CVE-2020-10914

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper...