Veeam Security Updates – 05 December 2024

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, gain elevated privileges, conduct DLL injection attacks, obtain sensitive information, manipulate data or execute arbitrary code, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Veeam Backup & Replication Denial of Service Vulnerability (CVE-2024- 42453):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Denial of Service

2. Veeam Backup & Replication Privilege Escalation Vulnerability (CVE-2024- 42456):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

The affected products:

• Veeam Backup & Replication versions 12, 12.1 and 12.2.
• Veeam Agent for Microsoft Windows versions 6.0, 6.1 and 6.2.
• Veeam Service Provider Console version 8.1.