Customers of Veeam Backup Enterprise Supervisor are being urged to replace to the newest model following the invention of a essential security flaw that would allow an adversary to bypass authentication protections.
Tracked as CVE-2024-29849 (CVSS rating: 9.8), the vulnerability may enable an unauthenticated attacker to log in to the Veeam Backup Enterprise Supervisor net interface as any person.
The corporate has additionally disclosed three different shortcomings impacting the identical product –
- CVE-2024-29850 (CVSS rating: 8.8), which permits account takeover through NTLM relay
- CVE-2024-29851 (CVSS rating: 7.2), which permits a privileged person to steal NTLM hashes of a Veeam Backup Enterprise Supervisor service account if it isn’t configured to run because the default Native System account
- CVE-2024-29852 (CVSS rating: 2.7), which permits a privileged person to learn backup session logs
All the issues have been addressed in model 12.1.2.172. Nevertheless, Veeam famous that deploying Veeam Backup Enterprise Supervisor is non-compulsory and that environments that wouldn’t have it put in are usually not impacted by the issues.
In latest weeks, the corporate has additionally resolved an area privilege escalation flaw affecting the Veeam Agent for Home windows (CVE-2024-29853, CVSS rating: 7.2) and a essential distant code execution bug impacting Veeam Service Supplier Console (CVE-2024-29212, CVSS rating: 9.9).
“Attributable to an unsafe deserialization technique utilized by the Veeam Service Supplier Console (VSPC) server in communication between the administration agent and its elements, beneath sure situations, it’s potential to carry out Distant Code Execution (RCE) on the VSPC server machine,” Veeam mentioned of CVE-2024-29212.
Safety flaws in Veeam Backup & Replication software program (CVE-2023-27532, CVSS rating: 7.5) have been exploited by menace actors like FIN7 and Cuba for deploying malicious payloads, together with ransomware, making it crucial that customers transfer shortly to patch the aforementioned vulnerabilities.
